The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Java | — | Upgrade to Apple Java version 1.6.0.22Upgrade to Apple Java version 1.5.0.26 | Jan 26, 2012 | May 19, 2010 |
| Centos_linux | — | Upgrade krb5-libsUpgrade krb5-workstationUpgrade krb5-serverUpgrade krb5-devel | Dec 1, 2016 | May 19, 2010 |
| Debian | — | Upgrade krb5Upgrade heimdal | Jul 30, 2024 | May 19, 2010 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Oct 30, 2017 | May 19, 2010 |
| Hpux | — | Update krb5client.KRB5-SHLIB-A to the latest versionApply patch PHSS_41166 from HPUpdate krb5client.KRB5-64SLIB-A to the latest versionApply patch PHSS_41168 from HPUpdate krb5client.KRB5IA32SLIB-A to the latest versionUpdate krb5client.KRB5IA64SLIB-A to the latest versionApply patch PHSS_41167 from HPUpdate krb5client.KRB5-RUN-A to the latest versionUpdate krb5client.KRB5-PRG-A to the latest version | Aug 11, 2017 | May 19, 2010 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Oct 27, 2010 | May 19, 2010 |
| Oracle Missing Cpu Oct 2010 | — | Apply the October 2010 Critical Patch Update (CPU) for Oracle Database | Oct 15, 2010 | Oct 12, 2010 |
| Oracle_linux | — | Upgrade krb5-develUpgrade krb5-libsUpgrade krb5-serverUpgrade krb5-workstation | Oct 16, 2024 | May 19, 2010 |
| Suse | — | Upgrade java-1_6_0-ibm-jdbcUpgrade java-1_4_2-ibm-sap-develUpgrade java-1_4_2-ibmUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-devel-32bitUpgrade krb5-develUpgrade krb5-plugin-kdb-ldapUpgrade java-1_4_2-ibm-pluginUpgrade krb5-serverUpgrade java-1_6_0-ibmUpgrade krb5-x86Upgrade krb5-32bitUpgrade krb5-apps-clientsUpgrade java-1_6_0-ibm-pluginUpgrade java-1_6_0-ibm-fontsUpgrade krb5-docUpgrade krb5-plugin-preauth-spakeUpgrade krb5-apps-serversUpgrade krb5-plugin-preauth-otpUpgrade java-1_6_0-ibm-alsaUpgrade java-1_4_2-ibm-jdbcUpgrade java-1_4_2-ibm-sapUpgrade krb5-clientUpgrade krb5 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade krb5-kdcUpgrade krb5-admin-serverUpgrade libkrb53 | Nov 8, 2024 | May 19, 2010 |
| Vmsa 2010 0013 | — | Upgrade VMware ESX 3.5 to build number 283373Upgrade VMware ESX 4.0 to build number 294855 | Nov 19, 2010 | May 19, 2010 |
| Vmsa 2010 0016 | — | Upgrade VMware ESX 4.1 to build number 320092Upgrade VMware ESXi 4.1 to build number 320092 | Nov 22, 2010 | May 19, 2010 |
| Vmsa 2011 0003 | — | Upgrade VMware ESX 4.0 to build number 360236 | Dec 17, 2012 | May 19, 2010 |
| Vmsa 2011 0013 | — | Upgrade VMware ESX 4.1 to build number 502767 | Nov 22, 2011 | May 19, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub