PT-2012-1151 · Mit · Mit Kerberos 5

Emmanuel Bouillon · Published 2012-08-06 · Updated 2020-01-21 · CVE-2012-1014

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions 1.10.x through 1.10.2 MIT Kerberos 5 versions prior to 1.11.4

Description The issue is related to the process as req function in the Key Distribution Center (KDC) of MIT Kerberos 5, which does not initialize a certain structure member. This allows remote attackers to cause a denial of service or possibly execute arbitrary code via a malformed AS-REQ request. Multiple vulnerabilities in the mit-krb5 package can lead to violations of confidentiality, integrity, and availability of protected information, and can be exploited remotely.

Recommendations For versions 1.10.x through 1.10.2, update to version 1.10.3 or later. For versions prior to 1.11.4, update to version 1.11.4 or later. As a temporary workaround, consider restricting access to the KDC to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-09675

CVE-2012-1014

DSA-2518-1

Affected Products

Mit Kerberos 5

References · 10

• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-1014 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-1014 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09675 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2012-1014 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2012-08/msg00016.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-1014 · Security Note
• http://debian.org/security/2012/dsa-2518 · Vendor Advisory
• https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc · Note
• http://security.gentoo.org/glsa/glsa-201312-12.xml · Note