CVE-2011-0284

MIT Kerberos 5 1.7-1.9 - Use-After-Free in KDC PKINIT e_data Field Handling

Title source: llm
STIX 2.1

Description

Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT feature is enabled, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an e_data field containing typed data.

References (23)

Core 23
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0680
Patch, US Government Resource third-party-advisory x_refsource_cert-vn
http://www.kb.cert.org/vuls/id/943220
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0673
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/46881
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056579.html
Patch, Vendor Advisory x_refsource_confirm
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66101
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0722
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0763
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1088-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056413.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056573.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43700
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:048
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0356.html
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0672
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43783
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43760
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/71183
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/517029/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://securitytracker.com/id?1025216
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43881

Scores

EPSS 0.2264
EPSS Percentile 95.9%

Details

CWE
CWE-399
Status published
Products (7)
mit/kerberos_5 1.7
mit/kerberos_5 1.7.1
mit/kerberos_5 1.8
mit/kerberos_5 1.8.1
mit/kerberos_5 1.8.2
mit/kerberos_5 1.8.3
mit/kerberos_5 1.9
Published Mar 20, 2011
Tracked Since Feb 18, 2026