PT-2011-1160 · Mit+1 · Mit-Krb5+1
Keiichi Mori
·
Publicado
2011-02-08
·
Atualizado
2024-06-15
·
CVE-2010-4022
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
mit-krb5 versions prior to 1.9.2
Description
The issue affects the mit-krb5 package in Gentoo Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. The
do standalone function in the MIT krb5 KDC database propagation daemon (kpropd) does not properly handle abnormal exits of worker child processes when in standalone mode, allowing remote attackers to cause a denial of service. This denial of service can result in the termination of the listening process, preventing new connections and updates in slave KDC.Recommendations
For mit-krb5 versions prior to 1.9.2, update to version 1.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the
kpropd daemon to minimize the risk of exploitation.Correção
DoS
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Mit-Krb5