PT-2011-5242 · Mit+1 · Krb5-Devel+10
Mark Deneen
·
Published
1970-01-01
·
Updated
2024-06-15
·
CVE-2011-1528
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
MIT Kerberos 5 versions 1.8 through 1.8.4
MIT Kerberos 5 versions 1.9 through 1.9.1
mit-krb5 versions prior to 1.9.2-r1
krb5-plugin-kdb-ldap (affected versions not specified)
krb5-server (affected versions not specified)
krb5-devel-32bit (affected versions not specified)
krb5-devel (affected versions not specified)
krb5 (affected versions not specified)
krb5-32bit (affected versions not specified)
krb5-client (affected versions not specified)
krb5-plugin-preauth-pkinit (affected versions not specified)
Description
The issue is related to multiple vulnerabilities in the MIT Kerberos 5 package, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely. The
krb5 ldap lockout audit function in the Key Distribution Center (KDC) is affected when the LDAP back end is used, allowing remote attackers to cause a denial of service via unspecified vectors.Recommendations
For MIT Kerberos 5 versions 1.8 through 1.8.4 and 1.9 through 1.9.1, update to a version outside of these ranges to resolve the issue.
For mit-krb5 versions prior to 1.9.2-r1, update to version 1.9.2-r1 or later.
For krb5-plugin-kdb-ldap, krb5-server, krb5-devel-32bit, krb5-devel, krb5, krb5-32bit, krb5-client, and krb5-plugin-preauth-pkinit, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
DoS
RCE
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Mit Kerberos 5
Red Hat
Krb5
Krb5-32Bit
Krb5-Client
Krb5-Devel
Krb5-Devel-32Bit
Krb5-Plugin-Kdb-Ldap
Krb5-Plugin-Preauth-Pkinit
Krb5-Server
Mit-Krb5