PT-2011-1162 · Mit+1 · Mit-Krb5+2

Published 2011-02-08 · Updated 2024-06-15 · CVE-2011-0282

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions 1.6.x through 1.9 mit-krb5 versions prior to 1.9.2-r1

Description The issue allows remote attackers to cause a denial of service, potentially leading to a daemon crash, via a crafted principal name when an LDAP backend is used in MIT Kerberos 5. This can result in disruption of confidentiality, integrity, and availability of protected information. The exploitation can be carried out remotely.

Recommendations For MIT Kerberos 5 versions 1.6.x through 1.9, consider updating to a version later than 1.9 to resolve the issue. For mit-krb5 versions prior to 1.9.2-r1, update to version 1.9.2-r1 or later to fix the problem. As a temporary workaround, consider restricting access to the LDAP backend to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09426

CVE-2011-0282

OPENSUSE-SU-2024:10004-1

RHSA-2011:0199

RHSA-2011:0200

RHSA-2011_0199

RHSA-2011_0200

Affected Products

Mit Kerberos 5

Red Hat

Mit-Krb5

References · 88

• http://mandriva.com/security/advisories?name=MDVSA-2011:024 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2011:025 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0200.html · Vendor Advisory
• http://vupen.com/english/advisories/2011/0347 · Vendor Advisory
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt · Vendor Advisory
• http://secunia.com/advisories/43260 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0282 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0199.html · Vendor Advisory
• http://secunia.com/advisories/43275 · Vendor Advisory
• http://vupen.com/english/advisories/2011/0333 · Vendor Advisory
• http://secunia.com/advisories/43273 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-0282 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-0200.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09426 · Security Note