Описание
The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | krb5 | Not affected | ||
| Extras for RHEL 4 | java-1.6.0-sun | Fixed | RHSA-2010:0770 | 14.10.2010 |
| Extras for RHEL 4 | java-1.5.0-ibm | Fixed | RHSA-2010:0807 | 27.10.2010 |
| Extras for RHEL 4 | java-1.4.2-ibm | Fixed | RHSA-2010:0935 | 01.12.2010 |
| Extras for RHEL 4 | java-1.6.0-ibm | Fixed | RHSA-2010:0987 | 15.12.2010 |
| Extras for RHEL 4 | java-1.4.2-ibm | Fixed | RHSA-2011:0152 | 17.01.2011 |
| Red Hat Enterprise Linux 3 | krb5 | Fixed | RHSA-2010:0423 | 18.05.2010 |
| Red Hat Enterprise Linux 4 | krb5 | Fixed | RHSA-2010:0423 | 18.05.2010 |
| Red Hat Enterprise Linux 5 | krb5 | Fixed | RHSA-2010:0423 | 18.05.2010 |
| Red Hat Enterprise Linux 6 Supplementary | java-1.5.0-ibm | Fixed | RHSA-2010:0873 | 10.11.2010 |
Показывать по
Дополнительная информация
Статус:
EPSS
4 Medium
CVSS2
Связанные уязвимости
The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-AP ...
The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
EPSS
4 Medium
CVSS2