PT-2006-1087 · Mit · Kerberos 5+1

Andrew Korty · Published 2006-12-31 · Updated 2024-06-15 · CVE-2006-6143

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: mit-krb5 versions prior to 1.5.2 Kerberos 5 versions 1.4 through 1.4.4 Kerberos 5 versions 1.5 through 1.5.1

Description: The issue affects the RPC library in Kerberos 5, which can be exploited remotely, potentially leading to a denial of service or arbitrary code execution. This could compromise the confidentiality, integrity, and availability of protected information.

Recommendations: For mit-krb5 versions prior to 1.5.2, update to version 1.5.2 or later. For Kerberos 5 versions 1.4 through 1.4.4, update to a version outside of this range. For Kerberos 5 versions 1.5 through 1.5.1, update to a version outside of this range. As a temporary workaround, consider restricting access to the RPC library in Kerberos 5 to minimize the risk of exploitation.

Fix

Access of Uninitialized Pointer

Weakness Enumeration

CWE-824

Related Identifiers

BDU:2015-09545

CVE-2006-6143

OPENSUSE-SU-2024:10899-1

Affected Products

Kerberos 5

Mit-Krb5

References · 55

• http://fedoranews.org/cms/node/2375 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200701-21.xml · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09545 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-6143 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2006-6143 · Vendor Advisory
• http://openpkg.com/security/advisories/OpenPKG-SA-2007.006.html · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html · Vendor Advisory
• http://ubuntu.com/usn/usn-408-1 · Vendor Advisory
• http://kb.cert.org/vuls/id/481564 · Patch
• http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-6143 · Vendor Advisory
• http://fedoranews.org/cms/node/2376 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6143 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10899-1 · Vendor Advisory
• http://us-cert.gov/cas/techalerts/TA07-009B.html · Patch