Description
MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.
References (27)
Core 27
Core References
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3094
Patch, Vendor Advisory x_refsource_confirm
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:246
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html
Various Sources x_refsource_confirm
http://kb.vmware.com/kb/1035108
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3118
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0187
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/514953/100/0/threaded
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
Vendor Advisory x_refsource_confirm
http://www.vmware.com/security/advisories/VMSA-2011-0007.html
Mailing List vendor-advisory
x_refsource_apple
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/69609
Mailing List vendor-advisory
x_refsource_hp
http://marc.info/?l=bugtraq&m=129562442714657&w=2
Vendor Advisory x_refsource_confirm
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3095
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/42399
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/45116
Various Sources mailing-list
x_refsource_mlist
http://lists.vmware.com/pipermail/security-announce/2011/000133.html
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id?1024803
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/517739/100/0/threaded
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0925.html
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1030-1
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/43015
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4581
Scores
CVSS v3
3.7
EPSS
0.0350
EPSS Percentile
87.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-310
Status
published
Products (6)
mit/kerberos_5
1.7
mit/kerberos_5
1.7.1
mit/kerberos_5
1.8
mit/kerberos_5
1.8.1
mit/kerberos_5
1.8.2
mit/kerberos_5
1.8.3
Published
Dec 02, 2010
Tracked Since
Feb 18, 2026