certfr_avis - CERTA-2012-AVI-309

CERTA-2012-AVI-309

Vulnerability from certfr_avis - Published: - Updated:

Le démon kadmind de MIT Kerberos présente une vulnérabilité qui permet de réaliser un déni de service à distance.

Solution

La version 1.10.2 de MIT Kerberos corrige cette vulnérabilité.

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

MIT Kerberos 1.10.x.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

CVE-2012-1013 (GCVE-0-2012-1013)

Vulnerability from cvelistv5 – Published: 2012-06-07 19:00 – Updated: 2024-08-06 18:45

Summary

The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password.

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	http://krbdev.mit.edu/rt/Ticket/Display.html?user…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/53784	vdb-entryx_refsource_BID
	http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
	http://rhn.redhat.com/errata/RHSA-2012-1131.html	vendor-advisoryx_refsource_REDHAT
	http://web.mit.edu/kerberos/krb5-1.10/	x_refsource_CONFIRM
	https://bugzilla.redhat.com/show_bug.cgi?id=827517	x_refsource_CONFIRM
	https://hermes.opensuse.org/messages/15083635	vendor-advisoryx_refsource_SUSE
	https://github.com/krb5/krb5/commit/c5be6209311d4…	x_refsource_CONFIRM
	http://mailman.mit.edu/pipermail/kerberos-announc…	mailing-listx_refsource_MLIST

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T18:45:26.661Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest\u0026pass=guest\u0026id=7152"
          },
          {
            "name": "53784",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/53784"
          },
          {
            "name": "MDVSA-2012:102",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:102"
          },
          {
            "name": "RHSA-2012:1131",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2012-1131.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/krb5-1.10/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827517"
          },
          {
            "name": "openSUSE-SU-2012:0834",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "https://hermes.opensuse.org/messages/15083635"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/c5be6209311d4a8f10fda37d0d3f876c1b33b77b"
          },
          {
            "name": "[kerberos-announce] 20120531 krb5-1.10.2 is released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mailman.mit.edu/pipermail/kerberos-announce/2012q2/000136.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-05-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2012-07-23T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest\u0026pass=guest\u0026id=7152"
        },
        {
          "name": "53784",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/53784"
        },
        {
          "name": "MDVSA-2012:102",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:102"
        },
        {
          "name": "RHSA-2012:1131",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2012-1131.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/krb5-1.10/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827517"
        },
        {
          "name": "openSUSE-SU-2012:0834",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "https://hermes.opensuse.org/messages/15083635"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/c5be6209311d4a8f10fda37d0d3f876c1b33b77b"
        },
        {
          "name": "[kerberos-announce] 20120531 krb5-1.10.2 is released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mailman.mit.edu/pipermail/kerberos-announce/2012q2/000136.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2012-1013",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest\u0026pass=guest\u0026id=7152",
              "refsource": "CONFIRM",
              "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest\u0026pass=guest\u0026id=7152"
            },
            {
              "name": "53784",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/53784"
            },
            {
              "name": "MDVSA-2012:102",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2012:102"
            },
            {
              "name": "RHSA-2012:1131",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2012-1131.html"
            },
            {
              "name": "http://web.mit.edu/kerberos/krb5-1.10/",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/krb5-1.10/"
            },
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=827517",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827517"
            },
            {
              "name": "openSUSE-SU-2012:0834",
              "refsource": "SUSE",
              "url": "https://hermes.opensuse.org/messages/15083635"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/c5be6209311d4a8f10fda37d0d3f876c1b33b77b",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/c5be6209311d4a8f10fda37d0d3f876c1b33b77b"
            },
            {
              "name": "[kerberos-announce] 20120531 krb5-1.10.2 is released",
              "refsource": "MLIST",
              "url": "http://mailman.mit.edu/pipermail/kerberos-announce/2012q2/000136.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2012-1013",
    "datePublished": "2012-06-07T19:00:00",
    "dateReserved": "2012-02-07T00:00:00",
    "dateUpdated": "2024-08-06T18:45:26.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted