PT-2001-1057 · Mit · Krb5-Devel+5

Greg Pryzby + 1 · Published 2001-08-02 · Updated 2020-01-21 · CVE-2003-0058

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions krb5-workstation versions 1.1.1 through 1.2.2 krb5-devel versions 1.1.1 through 1.2.2 krb5-configs version 1.1.1 krb5-server versions 1.1.1 through 1.2.2 krb5-libs version 1.1.1 MIT Kerberos V5 Key Distribution Center (KDC) versions prior to 1.2.5

Description The issue affects the confidentiality, integrity, and availability of protected information. Exploitation of the vulnerabilities can be done remotely. The MIT Kerberos V5 Key Distribution Center (KDC) is vulnerable to a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference.

Recommendations For krb5-workstation versions 1.1.1 through 1.2.2, update to a version later than 1.2.2. For krb5-devel versions 1.1.1 through 1.2.2, update to a version later than 1.2.2. For krb5-configs version 1.1.1, update to a version later than 1.1.1. For krb5-server versions 1.1.1 through 1.2.2, update to a version later than 1.2.2. For krb5-libs version 1.1.1, update to a version later than 1.1.1. For MIT Kerberos V5 Key Distribution Center (KDC) versions prior to 1.2.5, update to version 1.2.5 or later.

Fix

Related Identifiers

BDU:2015-08132

BDU:2015-08133

BDU:2015-08135

BDU:2015-08136

BDU:2015-08137

BDU:2015-08139

BDU:2015-08142

BDU:2015-08143

BDU:2015-08145

BDU:2015-08146

CVE-2003-0058

Affected Products

Mit Kerberos V5 Key Distribution Center

Krb5-Configs

Krb5-Devel

Krb5-Libs

Krb5-Server

Krb5-Workstation

References · 26

• https://bdu.fstec.ru/vul/2015-08133 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2003-0058 · Security Note
• http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08137 · Security Note
• http://kb.cert.org/vuls/id/661243 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0058 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08136 · Security Note
• http://redhat.com/support/errata/RHSA-2003-051.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08139 · Security Note
• https://bdu.fstec.ru/vul/2015-08135 · Security Note
• http://securityfocus.com/bid/6683 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-0058 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08142 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2003-0058 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-052.html · Vendor Advisory