PT-2009-6749 · Mit+1 · Mit Kerberos 5+1

Jan Lieskovsky · Publicado 1970-01-01 · Atualizado 2024-06-15 · CVE-2009-4212

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (krb5) versions 1.3 through 1.6.3 MIT Kerberos 5 (krb5) versions 1.7 before 1.7.1 krb5-devel-64bit (affected versions not specified) krb5-debuginfo-32bit (affected versions not specified) krb5-x86 (affected versions not specified) mit-krb5 versions prior to 1.9.2-r1 krb5-plugin-preauth-pkinit-debuginfo (affected versions not specified) krb5-debuginfo-64bit (affected versions not specified) krb5-debugsource (affected versions not specified) krb5-debuginfo-x86 (affected versions not specified) krb5-64bit (affected versions not specified) krb5-debuginfo (affected versions not specified) krb5-apps-servers (affected versions not specified) krb5-apps-clients (affected versions not specified)

Description The issue involves multiple vulnerabilities in the krb5 package, which can lead to a disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely. The vulnerabilities are related to integer underflows in the AES and RC4 decryption functionality in the crypto library. This can cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid.

Recommendations For MIT Kerberos 5 (krb5) versions 1.3 through 1.6.3, update to a version outside of this range. For MIT Kerberos 5 (krb5) versions 1.7 before 1.7.1, update to version 1.7.1 or later. For mit-krb5 versions prior to 1.9.2-r1, update to version 1.9.2-r1 or later. For other affected packages, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

BDU:2015-04533

BDU:2015-05252

BDU:2015-05253

BDU:2015-05254

BDU:2015-05255

BDU:2015-05256

BDU:2015-05257

BDU:2015-05258

BDU:2015-05259

BDU:2015-05260

BDU:2015-05261

BDU:2015-05262

BDU:2015-09426

CVE-2009-4212

DSA-1969-1

OPENSUSE-SU-2024:10004-1

RHSA-2010:0029

RHSA-2010_0029

Produtos afetados

Mit Kerberos 5

Red Hat

Referências · 107

• https://suse.com/security/cve/CVE-2010-4020 · Nota
• https://suse.com/security/cve/CVE-2016-3120 · Nota
• http://secunia.com/advisories/40220 · Nota
• https://suse.com/security/cve/CVE-2014-4343 · Nota
• https://suse.com/security/cve/CVE-2015-8630 · Nota
• https://suse.com/security/cve/CVE-2015-2698 · Nota
• https://bdu.fstec.ru/vul/2015-05256 · Nota de Segurança
• https://suse.com/security/cve/CVE-2011-1529 · Nota
• https://suse.com/security/cve/CVE-2014-9422 · Nota
• http://support.apple.com/kb/HT4188 · Nota
• https://suse.com/security/cve/CVE-2009-0844 · Nota
• https://suse.com/security/cve/CVE-2014-5353 · Nota
• https://bdu.fstec.ru/vul/2015-05258 · Nota de Segurança
• https://suse.com/security/cve/CVE-2009-0847 · Nota
• https://bdu.fstec.ru/vul/2015-04533 · Nota de Segurança