PT-2011-1160 · Mit+1 · Mit-Krb5+1

Keiichi Mori · Published 2011-02-08 · Updated 2024-06-15 · CVE-2010-4022

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions mit-krb5 versions prior to 1.9.2

Description The issue affects the mit-krb5 package in Gentoo Linux, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Exploitation can occur remotely. The do standalone function in the MIT krb5 KDC database propagation daemon (kpropd) does not properly handle abnormal exits of worker child processes when in standalone mode, allowing remote attackers to cause a denial of service. This denial of service can result in the termination of the listening process, preventing new connections and updates in slave KDC.

Recommendations For mit-krb5 versions prior to 1.9.2, update to version 1.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the kpropd daemon to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-09426

CVE-2010-4022

OPENSUSE-SU-2024:10004-1

RHSA-2011:0200

RHSA-2011_0200

Affected Products

Red Hat

Mit-Krb5

References · 80

• http://mandriva.com/security/advisories?name=MDVSA-2011:025 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0200.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-4022 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0347 · Vendor Advisory
• http://secunia.com/advisories/43260 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html · Vendor Advisory
• http://secunia.com/advisories/43275 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-4022 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0333 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0200.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09426 · Security Note
• http://vupen.com/english/advisories/2011/0329 · Vendor Advisory
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10004-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4022 · Security Note