PT-2013-1201 · Mit+3 · Mit Kerberos 5+3

Publicado 2013-11-16 · Atualizado 2020-01-21 · CVE-2013-6800

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (aka krb5) versions 1.10.x through 1.11.3

Description The issue affects the Key Distribution Center (KDC) in MIT Kerberos 5 due to an unspecified third-party database module. It allows remote authenticated users to cause a denial of service via a crafted request, resulting in a NULL pointer dereference and daemon crash. Additionally, multiple vulnerabilities in the mit-krb5 package prior to version 1.11.4 may lead to breaches of confidentiality, integrity, and availability of protected information, with potential for remote exploitation.

Recommendations For versions 1.10.x through 1.11.3, update to version 1.11.4 or later to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-09675

CESA-2014_1389

CVE-2013-6800

RHSA-2014:1245

RHSA-2014:1389

RHSA-2014_1245

RHSA-2014_1389

USN-2310-1

Produtos afetados

Centos

Mit Kerberos 5

Red Hat

Ubuntu

Referências · 22

• https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc · Nota
• https://github.com/krb5/krb5/commit/c2ccf4197f697c4ff143b8a786acdd875e70a89d · Correção
• http://securityfocus.com/bid/63770 · Nota
• https://ubuntu.com/security/CVE-2014-4344 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-1415 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-09675 · Nota de Segurança
• https://osv.dev/vulnerability/USN-2310-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-4343 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2012-1016 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-4345 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2014-1389.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-6800 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-4342 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-201312-12.xml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6800 · Nota de Segurança