cve-2010-1324
Vulnerability from cvelistv5
Published
2010-12-02 16:00
Modified
2024-08-07 01:21
Severity ?
Summary
MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.
References
cve@mitre.orghttp://kb.vmware.com/kb/1035108
cve@mitre.orghttp://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
cve@mitre.orghttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html
cve@mitre.orghttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
cve@mitre.orghttp://lists.vmware.com/pipermail/security-announce/2011/000133.html
cve@mitre.orghttp://marc.info/?l=bugtraq&m=129562442714657&w=2
cve@mitre.orghttp://osvdb.org/69609
cve@mitre.orghttp://secunia.com/advisories/42399Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/43015
cve@mitre.orghttp://support.apple.com/kb/HT4581
cve@mitre.orghttp://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txtVendor Advisory
cve@mitre.orghttp://www.mandriva.com/security/advisories?name=MDVSA-2010:246
cve@mitre.orghttp://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Vendor Advisory
cve@mitre.orghttp://www.redhat.com/support/errata/RHSA-2010-0925.html
cve@mitre.orghttp://www.securityfocus.com/archive/1/514953/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/517739/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/45116
cve@mitre.orghttp://www.securitytracker.com/id?1024803
cve@mitre.orghttp://www.ubuntu.com/usn/USN-1030-1
cve@mitre.orghttp://www.vmware.com/security/advisories/VMSA-2011-0007.html
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/3094
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/3095
cve@mitre.orghttp://www.vupen.com/english/advisories/2010/3118
cve@mitre.orghttp://www.vupen.com/english/advisories/2011/0187
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936
Impacted products
n/an/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T01:21:18.670Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2010-3094",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3094"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
          },
          {
            "name": "MDVSA-2010:246",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:246"
          },
          {
            "name": "FEDORA-2010-18425",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://kb.vmware.com/kb/1035108"
          },
          {
            "name": "ADV-2010-3118",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3118"
          },
          {
            "name": "oval:org.mitre.oval:def:11936",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936"
          },
          {
            "name": "ADV-2011-0187",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2011/0187"
          },
          {
            "name": "20101130 MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021]",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/514953/100/0/threaded"
          },
          {
            "name": "SUSE-SR:2010:023",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2011-0007.html"
          },
          {
            "name": "APPLE-SA-2011-03-21-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html"
          },
          {
            "name": "69609",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/69609"
          },
          {
            "name": "HPSBUX02623",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129562442714657\u0026w=2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt"
          },
          {
            "name": "SSRT100355",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=129562442714657\u0026w=2"
          },
          {
            "name": "ADV-2010-3095",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3095"
          },
          {
            "name": "42399",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42399"
          },
          {
            "name": "45116",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/45116"
          },
          {
            "name": "[security-announce] 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.vmware.com/pipermail/security-announce/2011/000133.html"
          },
          {
            "name": "1024803",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1024803"
          },
          {
            "name": "20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/517739/100/0/threaded"
          },
          {
            "name": "FEDORA-2010-18409",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html"
          },
          {
            "name": "SUSE-SR:2010:024",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html"
          },
          {
            "name": "RHSA-2010:0925",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2010-0925.html"
          },
          {
            "name": "USN-1030-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-1030-1"
          },
          {
            "name": "43015",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/43015"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT4581"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2010-11-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2010-3094",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3094"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
        },
        {
          "name": "MDVSA-2010:246",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:246"
        },
        {
          "name": "FEDORA-2010-18425",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://kb.vmware.com/kb/1035108"
        },
        {
          "name": "ADV-2010-3118",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3118"
        },
        {
          "name": "oval:org.mitre.oval:def:11936",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936"
        },
        {
          "name": "ADV-2011-0187",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2011/0187"
        },
        {
          "name": "20101130 MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021]",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/514953/100/0/threaded"
        },
        {
          "name": "SUSE-SR:2010:023",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2011-0007.html"
        },
        {
          "name": "APPLE-SA-2011-03-21-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html"
        },
        {
          "name": "69609",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/69609"
        },
        {
          "name": "HPSBUX02623",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129562442714657\u0026w=2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt"
        },
        {
          "name": "SSRT100355",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=129562442714657\u0026w=2"
        },
        {
          "name": "ADV-2010-3095",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3095"
        },
        {
          "name": "42399",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42399"
        },
        {
          "name": "45116",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/45116"
        },
        {
          "name": "[security-announce] 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.vmware.com/pipermail/security-announce/2011/000133.html"
        },
        {
          "name": "1024803",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1024803"
        },
        {
          "name": "20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/517739/100/0/threaded"
        },
        {
          "name": "FEDORA-2010-18409",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html"
        },
        {
          "name": "SUSE-SR:2010:024",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html"
        },
        {
          "name": "RHSA-2010:0925",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2010-0925.html"
        },
        {
          "name": "USN-1030-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-1030-1"
        },
        {
          "name": "43015",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/43015"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT4581"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2010-1324",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2010-3094",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/3094"
            },
            {
              "name": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html",
              "refsource": "CONFIRM",
              "url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"
            },
            {
              "name": "MDVSA-2010:246",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:246"
            },
            {
              "name": "FEDORA-2010-18425",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html"
            },
            {
              "name": "http://kb.vmware.com/kb/1035108",
              "refsource": "CONFIRM",
              "url": "http://kb.vmware.com/kb/1035108"
            },
            {
              "name": "ADV-2010-3118",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/3118"
            },
            {
              "name": "oval:org.mitre.oval:def:11936",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936"
            },
            {
              "name": "ADV-2011-0187",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2011/0187"
            },
            {
              "name": "20101130 MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021]",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/514953/100/0/threaded"
            },
            {
              "name": "SUSE-SR:2010:023",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2011-0007.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2011-0007.html"
            },
            {
              "name": "APPLE-SA-2011-03-21-1",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html"
            },
            {
              "name": "69609",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/69609"
            },
            {
              "name": "HPSBUX02623",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=129562442714657\u0026w=2"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt"
            },
            {
              "name": "SSRT100355",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=129562442714657\u0026w=2"
            },
            {
              "name": "ADV-2010-3095",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/3095"
            },
            {
              "name": "42399",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/42399"
            },
            {
              "name": "45116",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/45116"
            },
            {
              "name": "[security-announce] 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console",
              "refsource": "MLIST",
              "url": "http://lists.vmware.com/pipermail/security-announce/2011/000133.html"
            },
            {
              "name": "1024803",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1024803"
            },
            {
              "name": "20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/517739/100/0/threaded"
            },
            {
              "name": "FEDORA-2010-18409",
              "refsource": "FEDORA",
              "url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html"
            },
            {
              "name": "SUSE-SR:2010:024",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html"
            },
            {
              "name": "RHSA-2010:0925",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2010-0925.html"
            },
            {
              "name": "USN-1030-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-1030-1"
            },
            {
              "name": "43015",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/43015"
            },
            {
              "name": "http://support.apple.com/kb/HT4581",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT4581"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2010-1324",
    "datePublished": "2010-12-02T16:00:00",
    "dateReserved": "2010-04-08T00:00:00",
    "dateUpdated": "2024-08-07T01:21:18.670Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2010-1324\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2010-12-02T16:22:20.880\",\"lastModified\":\"2020-01-21T15:46:02.220\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.\"},{\"lang\":\"es\",\"value\":\"MIT Kerberos 5 (tambi\u00e9n conocido como krb5)  v1.7.x y v1.8.x hasta v1.8.3 no determina correctamente la aceptabilidad de las sumas de comprobaci\u00f3n, lo que podr\u00eda permitir a un atacante remoto falsificar GSS tokens, ganar privilegios, o tener otro impacto no especificado mediante (1) una suma de comprobaci\u00f3n sin clave, (2) una suma de comprobaci\u00f3n PAC sin clave o (3) una suma de comprobaci\u00f3n KrbFastArmoredReq basada en una clave de RC4.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-310\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DFB1190E-BE7A-4C6B-862D-D5747C64E980\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mit:kerberos_5:1.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B09C090-B842-43C7-B8A6-DBF63D80FEC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mit:kerberos_5:1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36823B2B-5C72-4FF3-9301-FB263EB8CE09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mit:kerberos_5:1.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59AFA33E-FEBC-45F5-9EC6-8AA363163FB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mit:kerberos_5:1.8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04D83332-B2FD-4E86-A76C-C3F1CD3B3A31\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:mit:kerberos_5:1.8.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"758A0011-20ED-414A-9DF3-50A161DF8BC2\"}]}]}],\"references\":[{\"url\":\"http://kb.vmware.com/kb/1035108\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.vmware.com/pipermail/security-announce/2011/000133.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://marc.info/?l=bugtraq\u0026m=129562442714657\u0026w=2\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://osvdb.org/69609\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/42399\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/43015\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://support.apple.com/kb/HT4581\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.mandriva.com/security/advisories?name=MDVSA-2010:246\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.redhat.com/support/errata/RHSA-2010-0925.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/514953/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/517739/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/45116\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1024803\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1030-1\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2011-0007.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2010/3094\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2010/3095\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2010/3118\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2011/0187\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936\",\"source\":\"cve@mitre.org\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.