Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Kerberos | — | Apply OS X security update 2010-004Upgrade macOS to the latest version | Dec 16, 2011 | Jan 13, 2010 |
| Centos_linux | — | Upgrade krb5-libsUpgrade krb5-develUpgrade krb5-workstationUpgrade krb5-server | Dec 1, 2016 | Jan 13, 2010 |
| Debian | — | Upgrade krb5 | Jul 30, 2024 | Jan 13, 2010 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Oct 30, 2017 | Jan 13, 2010 |
| Oracle_linux | — | Upgrade krb5-workstationUpgrade krb5-develUpgrade krb5-serverUpgrade krb5-libs | Oct 16, 2024 | Jan 13, 2010 |
| Suse | — | Upgrade krb5-plugin-preauth-otpUpgrade krb5-docUpgrade krb5-serverUpgrade krb5Upgrade krb5-apps-clientsUpgrade krb5-apps-serversUpgrade krb5-plugin-kdb-ldapUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-32bitUpgrade krb5-clientUpgrade krb5-devel-32bitUpgrade krb5-x86Upgrade krb5-plugin-preauth-spakeUpgrade krb5-devel | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libkrb53Upgrade libk5crypto3 | Nov 8, 2024 | Jan 13, 2010 |
| Vmsa 2010 0009 1 Service Console Update | — | Upgrade VMware ESX 3.5 to build number 213532Upgrade VMware ESX 4.0 to build number 256968 | Sep 2, 2010 | Jan 13, 2010 |
| Vmsa 2010 0016 | — | Upgrade VMware ESX 4.1 to build number 320092Upgrade VMware ESXi 4.1 to build number 320092 | Nov 22, 2010 | Jan 13, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub