PT-2011-1163 · Mit · Mit Kerberos 5

Published 2011-02-10 · Updated 2020-01-21 · CVE-2011-0283

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (krb5) versions 1.9 through 1.9.2-r1 MIT Kerberos 5 (krb5) versions prior to 1.9.2-r1

Description The issue affects the Key Distribution Center (KDC) in MIT Kerberos 5, allowing remote attackers to cause a denial of service via a malformed request packet. This can lead to a NULL pointer dereference and daemon crash. Additionally, multiple vulnerabilities in the mit-krb5 package can compromise the confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions 1.9 through 1.9.2-r1, update to version 1.9.2-r1 or later to resolve the issue. For versions prior to 1.9.2-r1, update to version 1.9.2-r1 or later to resolve the issue. As a temporary workaround, consider restricting access to the KDC to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09426

CVE-2011-0283

Affected Products

Mit Kerberos 5

References · 10

• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-002.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0283 · Security Note
• http://vupen.com/english/advisories/2011/0330 · Vendor Advisory
• http://secunia.com/advisories/43260 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09426 · Security Note
• http://securityfocus.com/bid/46272 · Note
• http://securityfocus.com/archive/1/516299/100/0/threaded · Note
• http://securitytracker.com/id?1025037 · Note
• http://security.gentoo.org/glsa/glsa-201201-13.xml · Note
• http://securityreason.com/securityalert/8073 · Note