CVE-2010-1321

Опубликовано: 19 мая 2010

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.

Ссылки

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
Broken Link
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041615.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041645.html
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041654.html
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
Mailing List
Third Party Advisory
http://marc.info/?l=bugtraq&m=134254866602253&w=2
Issue Tracking
Third Party Advisory
http://osvdb.org/64744
Broken Link
http://secunia.com/advisories/39762
Third Party Advisory
http://secunia.com/advisories/39784
Third Party Advisory
http://secunia.com/advisories/39799
Third Party Advisory
http://secunia.com/advisories/39818
Third Party Advisory
http://secunia.com/advisories/39849
Third Party Advisory
http://secunia.com/advisories/40346
Third Party Advisory
http://secunia.com/advisories/40685
Third Party Advisory
http://secunia.com/advisories/41967
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*

Версия до 1.7.1 (включая)

cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*

Версия от 1.8 (включая) до 1.8.2 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:oracle:database_server:-:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:opensuse:opensuse:11.0:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.2:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:opensuse:11.3:*:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:-:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:*:*:*:*

Конфигурация 6

Одно из

cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02199

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-476

Связанные уязвимости

CVE-2010-1321

ubuntu

около 15 лет назад

CVE-2010-1321

redhat

около 15 лет назад

CVE-2010-1321

debian

около 15 лет назад

The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-AP ...

GHSA-pcm6-6x97-2mrc

github

около 3 лет назад

ELSA-2010-0423

oracle-oval

около 15 лет назад

ELSA-2010-0423: krb5 security update (IMPORTANT)

EPSS

Процентиль: 84%

0.02199

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-476