PT-2001-1053 · Mit · Krb5-Devel+5
Ken Raeburn
+2
·
Published
2001-08-02
·
Updated
2018-10-19
·
CVE-2003-0138
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
krb5-workstation versions 1.1.1 through 1.2.7
krb5-configs version 1.1.1
krb5-devel versions 1.1.1 through 1.2.7
krb5-server versions 1.1.1 through 1.2.7
krb5-libs versions 1.1.1 through 1.2.7
krb5 versions 1.1.1 through 1.2.7
Description
The issue affects the Kerberos protocol, allowing an attacker to impersonate any principal in a realm via a chosen-plaintext attack. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out remotely.
Recommendations
For krb5-workstation versions 1.1.1 through 1.2.7, update to a version that contains a fix for this issue.
For krb5-configs version 1.1.1, update to a version that contains a fix for this issue.
For krb5-devel versions 1.1.1 through 1.2.7, update to a version that contains a fix for this issue.
For krb5-server versions 1.1.1 through 1.2.7, update to a version that contains a fix for this issue.
For krb5-libs versions 1.1.1 through 1.2.7, update to a version that contains a fix for this issue.
For krb5 versions 1.1.1 through 1.2.7, update to a version that contains a fix for this issue.
As a temporary workaround, consider restricting access to the Kerberos protocol until a patch is available.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Krb5
Krb5-Configs
Krb5-Devel
Krb5-Libs
Krb5-Server
Krb5-Workstation