PT-2012-1151 · Mit · Mit Kerberos 5

Emmanuel Bouillon · Publicado 2012-08-06 · Atualizado 2020-01-21 · CVE-2012-1014

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions 1.10.x through 1.10.2 MIT Kerberos 5 versions prior to 1.11.4

Description The issue is related to the process as req function in the Key Distribution Center (KDC) of MIT Kerberos 5, which does not initialize a certain structure member. This allows remote attackers to cause a denial of service or possibly execute arbitrary code via a malformed AS-REQ request. Multiple vulnerabilities in the mit-krb5 package can lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions 1.10.x through 1.10.2, update to version 1.10.3 or later. For versions prior to 1.11.4, update to version 1.11.4 or later. As a temporary workaround, consider restricting access to the KDC to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-09675

CVE-2012-1014

DSA-2518-1

Produtos afetados

Mit Kerberos 5

Referências · 10

• https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc · Nota
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1014 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201312-12.xml · Nota
• https://osv.dev/vulnerability/CVE-2012-1014 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09675 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2012-1014 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-1014 · Nota de Segurança
• http://debian.org/security/2012/dsa-2518 · Aviso do Fabricante