The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Java | — | Upgrade to Apple Java version 1.5.0.26Upgrade to Apple Java version 1.6.0.22 | Jan 26, 2012 | May 19, 2010 |
| Centos_linux | — | Upgrade krb5-develUpgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-libs | Dec 1, 2016 | May 19, 2010 |
| Debian | — | Upgrade krb5Upgrade heimdal | Jul 30, 2024 | May 19, 2010 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Oct 30, 2017 | May 19, 2010 |
| Hpux | — | Apply patch PHSS_41166 from HPUpdate krb5client.KRB5-SHLIB-A to the latest versionUpdate krb5client.KRB5-64SLIB-A to the latest versionUpdate krb5client.KRB5-PRG-A to the latest versionUpdate krb5client.KRB5IA32SLIB-A to the latest versionApply patch PHSS_41167 from HPApply patch PHSS_41168 from HPUpdate krb5client.KRB5IA64SLIB-A to the latest versionUpdate krb5client.KRB5-RUN-A to the latest version | Aug 11, 2017 | May 19, 2010 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 27, 2010 | May 19, 2010 |
| Oracle Missing Cpu Oct 2010 | — | Apply the October 2010 Critical Patch Update (CPU) for Oracle Database | Oct 15, 2010 | Oct 12, 2010 |
| Oracle_linux | — | Upgrade krb5-libsUpgrade krb5-develUpgrade krb5-workstationUpgrade krb5-server | Oct 16, 2024 | May 19, 2010 |
| Suse | — | Upgrade krb5-apps-serversUpgrade java-1_4_2-ibm-sapUpgrade krb5-clientUpgrade krb5-apps-clientsUpgrade krb5-docUpgrade krb5-32bitUpgrade java-1_6_0-ibm-pluginUpgrade java-1_4_2-ibm-jdbcUpgrade krb5-plugin-preauth-spakeUpgrade java-1_6_0-ibm-fontsUpgrade krb5-plugin-preauth-otpUpgrade java-1_6_0-ibm-alsaUpgrade krb5Upgrade krb5-develUpgrade java-1_4_2-ibm-pluginUpgrade java-1_6_0-ibmUpgrade krb5-serverUpgrade java-1_4_2-ibmUpgrade krb5-plugin-kdb-ldapUpgrade java-1_6_0-ibm-jdbcUpgrade krb5-x86Upgrade krb5-plugin-preauth-pkinitUpgrade java-1_4_2-ibm-sap-develUpgrade krb5-devel-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libkrb53Upgrade krb5-kdcUpgrade krb5-admin-server | Nov 8, 2024 | May 19, 2010 |
| Vmsa 2010 0013 | — | Upgrade VMware ESX 3.5 to build number 283373Upgrade VMware ESX 4.0 to build number 294855 | Nov 19, 2010 | May 19, 2010 |
| Vmsa 2010 0016 | — | Upgrade VMware ESX 4.1 to build number 320092Upgrade VMware ESXi 4.1 to build number 320092 | Nov 22, 2010 | May 19, 2010 |
| Vmsa 2011 0003 | — | Upgrade VMware ESX 4.0 to build number 360236 | Dec 17, 2012 | May 19, 2010 |
| Vmsa 2011 0013 | — | Upgrade VMware ESX 4.1 to build number 502767 | Nov 22, 2011 | May 19, 2010 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub