CVE-2022-42898

Published: Dic 25, 2022 Last Modified: Apr 14, 2025 EU-VD ID: EUVD-2022-45956 Aliases: GSD-2022-42898
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 8,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high

Description

AI Translation Available

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has 'a similar bug.'

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0889
Percentile
0,9th
Updated

EPSS Score Trend (Last 90 Days)

190

Integer Overflow or Wraparound

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Availability Integrity Confidentiality Access Control Other
Potential Impacts:
Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Memory) Dos: Instability Modify Memory Execute Unauthorized Code Or Commands Bypass Protection Mechanism Alter Execution Logic Dos: Resource Consumption (Cpu)
Applicable Platforms
Languages: C, Not Language-Specific
Likelihood of Exploit: Medium
View CWE Details
Application

Heimdal by Heimdal Project

Product Information
Vendor Heimdal Project
Product Heimdal
Version Range Affected
To 7.7.1 (exclusive)
cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Samba by Samba

Product Information
Vendor Samba
Product Samba
Version Range Affected
From 4.16.0 (inclusive)
To 4.16.7 (exclusive)
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Samba by Samba

Product Information
Vendor Samba
Product Samba
Version Range Affected
To 4.15.12 (exclusive)
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Samba by Samba

Product Information
Vendor Samba
Product Samba
Version Range Affected
From 4.17.0 (inclusive)
To 4.17.3 (exclusive)
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Kerberos 5 by Mit

Product Information
Vendor Mit
Product Kerberos 5
Version Range Affected
From 1.8 (inclusive)
To 1.19.4 (exclusive)
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Kerberos 5 by Mit

Product Information
Vendor Mit
Product Kerberos 5
Version 1.20
cpe:2.3:a:mit:kerberos_5:1.20:beta1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Kerberos 5 by Mit

Product Information
Vendor Mit
Product Kerberos 5
Version 1.20
cpe:2.3:a:mit:kerberos_5:1.20:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://bugzilla.samba.org/show_bug.cgi?id=15203
Exploit Issue Tracking Patch Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=15203
https://github.com/heimdal/heimdal/security/advisories/GHSA…
Third Party Advisory
https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa…
Patch Third Party Advisory
https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
https://security.gentoo.org/glsa/202309-06
https://security.gentoo.org/glsa/202309-06
https://security.gentoo.org/glsa/202310-06
https://security.gentoo.org/glsa/202310-06
https://security.netapp.com/advisory/ntap-20230216-0008/
https://security.netapp.com/advisory/ntap-20230216-0008/
https://security.netapp.com/advisory/ntap-20230223-0001/
https://security.netapp.com/advisory/ntap-20230223-0001/
https://web.mit.edu/kerberos/advisories/
Vendor Advisory
https://web.mit.edu/kerberos/advisories/
https://web.mit.edu/kerberos/krb5-1.19/
Release Notes Vendor Advisory
https://web.mit.edu/kerberos/krb5-1.19/
https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
Vendor Advisory
https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
https://www.samba.org/samba/security/CVE-2022-42898.html
Third Party Advisory
https://www.samba.org/samba/security/CVE-2022-42898.html
https://bugzilla.samba.org/show_bug.cgi?id=15203
Exploit Issue Tracking Patch Third Party Advisory
https://bugzilla.samba.org/show_bug.cgi?id=15203
https://github.com/heimdal/heimdal/security/advisories/GHSA…
Third Party Advisory
https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa…
Patch Third Party Advisory
https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
https://security.gentoo.org/glsa/202309-06
https://security.gentoo.org/glsa/202309-06
https://security.gentoo.org/glsa/202310-06
https://security.gentoo.org/glsa/202310-06
https://security.netapp.com/advisory/ntap-20230216-0008/
https://security.netapp.com/advisory/ntap-20230216-0008/
https://security.netapp.com/advisory/ntap-20230223-0001/
https://security.netapp.com/advisory/ntap-20230223-0001/
https://web.mit.edu/kerberos/advisories/
Vendor Advisory
https://web.mit.edu/kerberos/advisories/
https://web.mit.edu/kerberos/krb5-1.19/
Release Notes Vendor Advisory
https://web.mit.edu/kerberos/krb5-1.19/
https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
Vendor Advisory
https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
https://www.samba.org/samba/security/CVE-2022-42898.html
Third Party Advisory
https://www.samba.org/samba/security/CVE-2022-42898.html