PT-2011-1166 · Mit+2 · Mit Kerberos 5+2
Simo Sorce
·
Published
2011-12-06
·
Updated
2024-06-15
·
CVE-2011-1530
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
mit-krb5 versions 1.9 through 1.9.2
mit-krb5 versions prior to 1.9.2-r1
Description
The issue affects the Key Distribution Center (KDC) in MIT Kerberos 5, allowing remote authenticated users to cause a denial of service via a crafted TGS request. This can lead to a NULL pointer dereference and daemon crash. The vulnerability may compromise the confidentiality, integrity, and availability of protected information.
Recommendations
For mit-krb5 versions 1.9 through 1.9.2, update to version 1.9.2-r1 or later to resolve the issue.
For mit-krb5 versions prior to 1.9.2-r1, update to version 1.9.2-r1 or later to resolve the issue.
As a temporary workaround, consider restricting access to the
process tgs req function in the Key Distribution Center (KDC) to minimize the risk of exploitation.Fix
DoS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Centos
Mit Kerberos 5
Red Hat