PT-2013-1160 · Mit+3 · Mit Kerberos 5+3
Nalin Dahyabhai
·
Publicado
2013-03-03
·
Atualizado
2024-06-15
·
CVE-2012-1016
CVSS v2.0
8.5
Alta
| Vetor | AV:N/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
MIT Kerberos 5 versions prior to 1.10.4
Description
The issue allows remote attackers to cause a denial of service via a crafted Draft 9 request. This is due to the pkinit server return padata function attempting to find an agility KDF identifier in inappropriate circumstances, leading to a NULL pointer dereference and daemon crash. The vulnerability can be exploited by a remote attacker who has passed the authentication procedure, potentially disrupting the confidentiality, integrity, and availability of protected information.
Recommendations
For versions prior to 1.10.4, update to version 1.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the
pkinit server return padata function in the plugins/preauth/pkinit/pkinit srv.c file until a patch is available.Correção
DoS
NULL Pointer Dereference
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Centos
Mit Kerberos 5
Red Hat
Ubuntu