ID CVE-2010-1323
Summary MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys.
References
Vulnerable Configurations
  • MIT Kerberos 5 1.3
    cpe:2.3:a:mit:kerberos:5-1.3
  • MIT Kerberos 5 1.3 alpha1
    cpe:2.3:a:mit:kerberos:5-1.3:alpha1
  • MIT Kerberos 5 1.3.1
    cpe:2.3:a:mit:kerberos:5-1.3.1
  • MIT Kerberos 5 1.3.2
    cpe:2.3:a:mit:kerberos:5-1.3.2
  • MIT Kerberos 5 1.3.3
    cpe:2.3:a:mit:kerberos:5-1.3.3
  • MIT Kerberos 5 1.3.4
    cpe:2.3:a:mit:kerberos:5-1.3.4
  • MIT Kerberos 5 1.3.5
    cpe:2.3:a:mit:kerberos:5-1.3.5
  • MIT Kerberos 5 1.3.6
    cpe:2.3:a:mit:kerberos:5-1.3.6
  • MIT Kerberos 5 1.4
    cpe:2.3:a:mit:kerberos:5-1.4
  • MIT Kerberos 5 1.4.1
    cpe:2.3:a:mit:kerberos:5-1.4.1
  • MIT Kerberos 5 1.4.2
    cpe:2.3:a:mit:kerberos:5-1.4.2
  • MIT Kerberos 5 1.4.3
    cpe:2.3:a:mit:kerberos:5-1.4.3
  • MIT Kerberos 5 1.4.4
    cpe:2.3:a:mit:kerberos:5-1.4.4
  • MIT Kerberos 5 1.5
    cpe:2.3:a:mit:kerberos:5-1.5
  • MIT Kerberos 5 1.5.1
    cpe:2.3:a:mit:kerberos:5-1.5.1
  • MIT Kerberos 5 1.5.2
    cpe:2.3:a:mit:kerberos:5-1.5.2
  • MIT Kerberos 5 1.5.3
    cpe:2.3:a:mit:kerberos:5-1.5.3
  • cpe:2.3:a:mit:kerberos:5-1.5.4
    cpe:2.3:a:mit:kerberos:5-1.5.4
  • MIT Kerberos 5 1.6
    cpe:2.3:a:mit:kerberos:5-1.6
  • MIT Kerberos 5 1.6.1
    cpe:2.3:a:mit:kerberos:5-1.6.1
  • MIT Kerberos 5 1.6.2
    cpe:2.3:a:mit:kerberos:5-1.6.2
  • MIT Kerberos 5 1.7
    cpe:2.3:a:mit:kerberos:5-1.7
  • MIT Kerberos 5 1.7.1
    cpe:2.3:a:mit:kerberos:5-1.7.1
  • MIT Kerberos 5 1.8
    cpe:2.3:a:mit:kerberos:5-1.8
  • MIT Kerberos 5 1.8.1
    cpe:2.3:a:mit:kerberos:5-1.8.1
  • MIT Kerberos 5 1.8.2
    cpe:2.3:a:mit:kerberos:5-1.8.2
  • MIT Kerberos 5 1.8.3
    cpe:2.3:a:mit:kerberos:5-1.8.3
CVSS
Base: 2.6 (as of 31-03-2016 - 09:56)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK HIGH NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_10_6_7.NASL
    description The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7. Mac OS X 10.6.7 contains security fixes for the following products : - AirPort - Apache - AppleScript - ATS - bzip2 - CarbonCore - ClamAV - CoreText - File Quarantine - HFS - ImageIO - Image RAW - Installer - Kerberos - Kernel - Libinfo - libxml - Mailman - PHP - QuickLook - QuickTime - Ruby - Samba - Subversion - Terminal - X11
    last seen 2019-02-21
    modified 2018-08-22
    plugin id 52754
    published 2011-03-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=52754
    title Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20101130_KRB5_ON_SL4_X.NASL
    description Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms. (CVE-2010-1323) After installing the updated packages, the krb5kdc daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2019-01-02
    plugin id 60910
    published 2012-08-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=60910
    title Scientific Linux Security Update : krb5 on SL4.x, SL5.x i386/x86_64
  • NASL family Gentoo Local Security Checks
    NASL id GENTOO_GLSA-201201-13.NASL
    description The remote host is affected by the vulnerability described in GLSA-201201-13 (MIT Kerberos 5: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able to execute arbitrary code with the privileges of the administration daemon or the Key Distribution Center (KDC) daemon, cause a Denial of Service condition, or possibly obtain sensitive information. Furthermore, a remote attacker may be able to spoof Kerberos authorization, modify KDC responses, forge user data messages, forge tokens, forge signatures, impersonate a client, modify user-visible prompt text, or have other unspecified impact. Workaround : There is no known workaround at this time.
    last seen 2019-02-21
    modified 2018-07-11
    plugin id 57655
    published 2012-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=57655
    title GLSA-201201-13 : MIT Kerberos 5: Multiple vulnerabilities
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2011-0007.NASL
    description a. ESX/ESXi Socket Exhaustion By sending malicious network traffic to an ESXi or ESX host an attacker could exhaust the available sockets which would prevent further connections to the host. In the event a host becomes inaccessible its virtual machines will continue to run and have network connectivity but a reboot of the ESXi or ESX host may be required in order to be able to connect to the host again. ESXi and ESX hosts may intermittently lose connectivity caused by applications that do not correctly close sockets. If this occurs an error message similar to the following may be written to the vpxa log : socket() returns -1 (Cannot allocate memory) An error message similar to the following may be written to the vmkernel logs : socreate(type=2, proto=17) failed with error 55 VMware would like to thank Jimmy Scott at inet-solutions.be for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2011-1785 to this issue. b. Likewise package update Updates to the vmware-esx-likewise-openldap and vmware-esx-likewise-krb5 packages address several security issues. One of the vulnerabilities is specific to Likewise while the other vulnerabilities are present in the MIT version of krb5. An incorrect assert() call in Likewise may lead to a termination of the Likewise-open lsassd service if a username with an illegal byte sequence is entered for user authentication when logging in to the Active Directory domain of the ESXi/ESX host. This would lead to a denial of service. The MIT-krb5 vulnerabilities are detailed in MITKRB5-SA-2010-007. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-1786 (Likewise-only issue), CVE-2010-1324, CVE-2010-1323, CVE-2010-4020, CVE-2010-4021 to these issues. c. ESX third-party update for Service Console kernel The Service Console kernel is updated to include a fix for a security issue. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-2240 to this issue.
    last seen 2019-02-21
    modified 2018-09-06
    plugin id 53592
    published 2011-04-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=53592
    title VMSA-2011-0007 : VMware ESXi and ESX Denial of Service and third-party updates for Likewise components and ESX Service Console
  • NASL family Solaris Local Security Checks
    NASL id SOLARIS11_KERBEROS_20130924_2.NASL
    description The remote Solaris system is missing necessary patches to address security updates : - The merge_authdata function in kdc_authdata.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x before 1.8.4 does not properly manage an index into an authorization-data list, which allows remote attackers to cause a denial of service (daemon crash), or possibly obtain sensitive information, spoof authorization, or execute arbitrary code, via a TGS request that triggers an uninitialized pointer dereference, as demonstrated by a request from a Windows Active Directory client. (CVE-2010-1322) - MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys. (CVE-2010-1323) - MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key. (CVE-2010-1324) - MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations. (CVE-2010-4020) - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS requests, which might allow remote authenticated users to impersonate a client by rewriting an inner request, aka a 'KrbFastReq forgery issue.' (CVE-2010-4021) - Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT feature is enabled, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an e_data field containing typed data. (CVE-2011-0284)
    last seen 2019-02-21
    modified 2018-11-15
    plugin id 80653
    published 2015-01-19
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=80653
    title Oracle Solaris Third-Party Patch Update : kerberos (cve_2010_1322_improper_input)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2011-001.NASL
    description The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-001 applied. This security update contains fixes for the following products : - Apache - bzip2 - ClamAV - ImageIO - Kerberos - Libinfo - libxml - Mailman - PHP - QuickLook - Ruby - X11
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 52753
    published 2011-03-22
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=52753
    title Mac OS X Multiple Vulnerabilities (Security Update 2011-001)
  • NASL family HP-UX Local Security Checks
    NASL id HPUX_PHSS_41775.NASL
    description s700_800 11.31 KRB5-Client Version 1.3.5.03 Cumulative patch : Potential security vulnerabilities have been identified on HP-UX running Kerberos. These vulnerabilities could be exploited remotely by an unauthorized user to modify data, prompts, or responses.
    last seen 2019-02-21
    modified 2018-07-12
    plugin id 51659
    published 2011-01-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51659
    title HP-UX PHSS_41775 : HP-UX Running Kerberos, Remote Unauthorized Modification (HPSBUX02623 SSRT100355 rev.1)
  • NASL family Misc.
    NASL id VMWARE_VMSA-2011-0007_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities : - Multiple forgery vulnerabilities exist in the bundled version of MIT Kerberos 5 (krb5). An attacker can exploit these issues to impersonate a client, escalate privileges, and disclose sensitive information. (CVE-2010-1323, CVE-2010-1324, CVE-2010-4020, CVE-2010-4021) - A local arbitrary code execution vulnerability exists in the Kernel in the do_anonymous_page() function due to improper separation of the stack and the heap. A local attacker can exploit this vulnerability to execute arbitrary code. (CVE-2010-2240) - A denial of service vulnerability exists that allows a remote attacker to exhaust available sockets, preventing further connections. (CVE-2011-1785) - A denial of service vulnerability exists in the bundled version of lsassd in Likewise Open. A remote attacker can exploit this, via an Active Directory login attempt that provides a username containing an invalid byte sequence, to cause a daemon crash. (CVE-2011-1786)
    last seen 2019-02-21
    modified 2018-08-16
    plugin id 89676
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89676
    title VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0007) (remote check)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2129.NASL
    description A vulnerability has been found in krb5, the MIT implementation of Kerberos. MIT krb5 clients incorrectly accept unkeyed checksums in the SAM-2 preauthentication challenge: an unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token. MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying KRB-SAFE messages: an unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages. The Common Vulnerabilities and Exposures project has assigned CVE-2010-1323 to these issues.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 50865
    published 2010-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50865
    title Debian DSA-2129-1 : krb5 - checksum verification weakness
  • NASL family Misc.
    NASL id VMWARE_VMSA-2011-0012_REMOTE.NASL
    description The remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities in several third-party components and libraries : - Kernel - krb5 - glibc - mtp2sas - mptsas - mptspi
    last seen 2019-02-21
    modified 2018-08-16
    plugin id 89680
    published 2016-03-04
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=89680
    title VMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0012) (remote check)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-18425.NASL
    description This update incorporates the upstream patches to correct bugs outlined in MITKRB5-SA-2010-007 (CVE-2010-1323, CVE-2010-1324, and CVE-2010-4020). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-12-08
    plugin id 51099
    published 2010-12-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51099
    title Fedora 13 : krb5-1.7.1-16.fc13 (2010-18425)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0925.NASL
    description Updated krb5 packages that fix multiple security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC). Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication or authorization mechanisms and escalate their privileges. (CVE-2010-1323, CVE-2010-1324, CVE-2010-4020) Red Hat would like to thank the MIT Kerberos Team for reporting these issues. This update also fixes the following bug : * When attempting to perform PKINIT pre-authentication, if the client had more than one possible candidate certificate the client could fail to select the certificate and key to use. This usually occurred if certificate selection was configured to use the value of the keyUsage extension, or if any of the candidate certificates did not contain a subjectAltName extension. Consequently, the client attempted to perform pre-authentication using a different (usually password-based) mechanism. (BZ#644825) All krb5 users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 50852
    published 2010-12-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50852
    title RHEL 6 : krb5 (RHSA-2010:0925)
  • NASL family OracleVM Local Security Checks
    NASL id ORACLEVM_OVMSA-2011-0015.NASL
    description The remote OracleVM system is missing necessary patches to address critical security updates : - Fix for (CVE-2011-4862) - incorporate a fix to teach the file labeling bits about when replay caches are expunged (#712453) - rebuild - ftp: handle larger command inputs (#665833) - don't bail halfway through an unlock operation when the result will be discarded and the end-result not cleaned up (Martin Osvald, #586032) - add a versioned dependency between krb5-server-ldap and krb5-libs (internal tooling) - don't discard the error code from an error message received in response to a change-password request (#658871, RT#6893) - ftpd: add patch from Jatin Nansi to correctly match restrict lines in /etc/ftpusers (#644215, RT#6889) - ftp: add modified patch from Rogan Kyuseok Lee to report the number of bytes transferred correctly when transferring large files on 32-bit systems (#648404) - backport fix for RT#6514: memory leak freeing rcache type none (#678205) - add upstream patch to fix hang or crash in the KDC when using the LDAP kdb backend (CVE-2011-0281, CVE-2011-0282, #671097) - incorporate upstream patch for checksum acceptance issues from MITKRB5-SA-2010-007 (CVE-2010-1323, #652308) - backport a fix to the previous change (#539423) - backport the k5login_directory and k5login_authoritative settings (#539423) - krshd: don't limit user names to 16 chars when utmp can handle names at least a bit longer than that (#611713) - fix a logic bug in computing key expiration times (RT#6762, #627038) - correct the post-rotate scriptlet in the kadmind logrotate config (more of #462658) - ftpd: backport changes to modify behavior to match telnetd,rshd,rlogind and accept GSSAPI auth to any service for which we have a matching key (#538075) - pull in fix for RT#5551 to treat the referral realm when seen in a ticket as though it were the local realm (#498554, also very likely #450122) - add aes256-cts:normal and aes128-cts:normal to the list of keysalts in the default kdc.conf (part of #565941) - add a note to kdc.conf(5) pointing to the admin guide for the list of recognized key and salt types (the rest of #565941) - add logrotate configuration files for krb5kdc and kadmind (#462658) - libgssapi: backport patch from svn to stop returning context-expired errors when the ticket which was used to set up the context expires (#605367, upstream #6739) - enable building the -server-ldap subpackage (#514362) - stop caring about the endianness of stash files (#514741), which will be replaced by proper keytab files in later releases - don't crash in krb5_get_init_creds_password if the passed-in options struct is NULL and the clients keys have expired (#555875) - ksu: perform PAM account and session management before dropping privileges to those of the target user (#540769 and #596887, respectively) - add candidate patch to correct libgssapi null pointer dereference which could be triggered by malformed client requests (CVE-2010-1321, #583704) - fix a null pointer dereference and crash introduced in our PAM patch that would happen if ftpd was given the name of a user who wasnt known to the local system, limited to being triggerable by gssapi-authenticated clients by the default xinetd config (Olivier Fourdan, #569472) - add upstream patch to fix a few use-after-free bugs, including one in kadmind (CVE-2010-0629, #578186) - merge patch to correct KDC integer overflows which could be triggered by malformed RC4 and AES ciphertexts (CVE-2009-4212, #546348) - pull changes to libkrb5 to properly handle and chase off-path referrals back from 1.7 (#546538) - add an auth stack to ksus PAM configuration so that it can successfully pam_setcred - also set PAM_RUSER in ksu for completeness (#479071+#477033) - fix various typos, except for bits pertaining to licensing (#499190) - kdb5_util: when renaming a database, if the new names associated lock files don't exist, go ahead and create them (#442879) - ksu: perform PAM account and session management for the target user authentication is still performed as before (#477033) - fix typo in ksus reporting of errors getting credentials (#462890) - kadmind.init: stop setting up a keytab, as kadminds been able to use the database directly for a while now (#473151) - pull up patch to set PAM_RHOST (James Leddy, #479071)
    last seen 2019-02-21
    modified 2018-11-05
    plugin id 79475
    published 2014-11-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79475
    title OracleVM 2.2 : krb5 (OVMSA-2011-0015)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_11BBCCBC03EE11E0BCDB001FC61C2A55.NASL
    description The MIT Kerberos team reports : MIT krb5 clients incorrectly accept an unkeyed checksums in the SAM-2 preauthentication challenge. An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token. MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying KRB-SAFE messages. An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 51101
    published 2010-12-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51101
    title FreeBSD : krb5 -- multiple checksum handling vulnerabilities (11bbccbc-03ee-11e0-bcdb-001fc61c2a55)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_1_KRB5-101201.NASL
    description Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software. CVE-2010-1323, CVE-2010-1324,CVE-2010-4020 and CVE-2010-4021 have been assigned to this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 53672
    published 2011-05-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=53672
    title openSUSE Security Update : krb5 (openSUSE-SU-2010:1053-1)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-245.NASL
    description A vulnerability was discovered and corrected in krb5 : An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token. An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages (CVE-2010-1323). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=4 90 The updated packages have been patched to correct this issue.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 50848
    published 2010-12-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50848
    title Mandriva Linux Security Advisory : krb5 (MDVSA-2010:245)
  • NASL family Mandriva Local Security Checks
    NASL id MANDRIVA_MDVSA-2010-246.NASL
    description Multiple vulnerabilities were discovered and corrected in krb5 : An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token. An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages (CVE-2010-1323). An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted pre-existing application session uses a DES session key. An authenticated remote attacker can forge PACs if using a KDC that does not filter client-provided PAC data. This can result in privilege escalation against a service that relies on PAC contents to make authorization decisions. An unauthenticated remote attacker has a 1/256 chance of swapping a client-issued KrbFastReq into a different KDC-REQ, if the armor key is RC4. The consequences are believed to be minor (CVE-2010-1324). An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the AD-SIGNEDPATH signature if the TGT key is RC4, allowing it to use self-generated evidence tickets for S4U2Proxy, instead of tickets obtained from the user or with S4U2Self. Configurations using RC4 for the TGT key are believed to be rare. An authenticated remote attacker has a 1/256 chance of forging AD-KDC-ISSUED signatures on authdata elements in tickets having an RC4 service key, resulting in privilege escalation against a service that relies on these signatures. There are no known uses of the KDC-ISSUED authdata container at this time (CVE-2010-4020. An authenticated remote attacker that controls a legitimate service principal could obtain a valid service ticket to itself containing valid KDC-generated authorization data for a client whose TGS-REQ it has intercepted. The attacker could then use this ticket for S4U2Proxy to impersonate the targeted client even if the client never authenticated to the subverted service. The vulnerable configuration is believed to be rare (CVE-2010-4021). The updated packages have been patched to correct this issue.
    last seen 2019-02-21
    modified 2018-07-19
    plugin id 50849
    published 2010-12-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50849
    title Mandriva Linux Security Advisory : krb5 (MDVSA-2010:246)
  • NASL family VMware ESX Local Security Checks
    NASL id VMWARE_VMSA-2011-0012.NASL
    description a. ESX third-party update for Service Console kernel This update takes the console OS kernel package to kernel-2.6.18-238.9.1 which resolves multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1083, CVE-2010-2492, CVE-2010-2798, CVE-2010-2938, CVE-2010-2942, CVE-2010-2943, CVE-2010-3015, CVE-2010-3066, CVE-2010-3067, CVE-2010-3078, CVE-2010-3086, CVE-2010-3296, CVE-2010-3432, CVE-2010-3442, CVE-2010-3477, CVE-2010-3699, CVE-2010-3858, CVE-2010-3859, CVE-2010-3865, CVE-2010-3876, CVE-2010-3877, CVE-2010-3880, CVE-2010-3904, CVE-2010-4072, CVE-2010-4073, CVE-2010-4075, CVE-2010-4080, CVE-2010-4081, CVE-2010-4083, CVE-2010-4157, CVE-2010-4158, CVE-2010-4161, CVE-2010-4238, CVE-2010-4242, CVE-2010-4243, CVE-2010-4247, CVE-2010-4248, CVE-2010-4249, CVE-2010-4251, CVE-2010-4255, CVE-2010-4263, CVE-2010-4343, CVE-2010-4346, CVE-2010-4526, CVE-2010-4655, CVE-2011-0521, CVE-2011-0710, CVE-2011-1010, CVE-2011-1090 and CVE-2011-1478 to these issues. b. ESX third-party update for Service Console krb5 RPMs This patch updates the krb5-libs and krb5-workstation RPMs of the console OS to version 1.6.1-55.el5_6.1, which resolves multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1323, CVE-2011-0281, and CVE-2011-0282 to these issues. c. ESXi and ESX update to third-party component glibc The glibc third-party library is updated to resolve multiple security issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0296, CVE-2011-0536, CVE-2011-1071, CVE-2011-1095, CVE-2011-1658, and CVE-2011-1659 to these issues. d. ESX update to third-party drivers mptsas, mpt2sas, and mptspi The mptsas, mpt2sas, and mptspi drivers are updated which addresses multiple security issues in the mpt2sas driver. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2011-1494 and CVE-2011-1495 to these issues.
    last seen 2019-02-21
    modified 2018-09-06
    plugin id 56508
    published 2011-10-14
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=56508
    title VMSA-2011-0012 : VMware ESXi and ESX updates to third-party libraries and ESX Service Console
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_3_KRB5-101201.NASL
    description Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software. CVE-2010-1323, CVE-2010-1324,CVE-2010-4020 and CVE-2010-4021 have been assigned to this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75559
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75559
    title openSUSE Security Update : krb5 (openSUSE-SU-2010:1053-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_2_KRB5-101201.NASL
    description Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software. CVE-2010-1323, CVE-2010-1324,CVE-2010-4020 and CVE-2010-4021 have been assigned to this issue.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 53742
    published 2011-05-05
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=53742
    title openSUSE Security Update : krb5 (openSUSE-SU-2010:1053-1)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2010-0926.NASL
    description Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC). Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms. (CVE-2010-1323) Red Hat would like to thank the MIT Kerberos Team for reporting these issues. All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-28
    plugin id 50853
    published 2010-12-01
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50853
    title RHEL 4 / 5 : krb5 (RHSA-2010:0926)
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2010-0926.NASL
    description Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC). Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms. (CVE-2010-1323) Red Hat would like to thank the MIT Kerberos Team for reporting these issues. All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 50863
    published 2010-12-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50863
    title CentOS 4 / 5 : krb5 (CESA-2010:0926)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2010-0926.NASL
    description From Red Hat Security Advisory 2010:0926 : Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC). Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms. (CVE-2010-1323) Red Hat would like to thank the MIT Kerberos Team for reporting these issues. All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 68152
    published 2013-07-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=68152
    title Oracle Linux 4 / 5 : krb5 (ELSA-2010-0926)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-1030-1.NASL
    description It was discovered that Kerberos did not properly determine the acceptability of certain checksums. A remote attacker could use certain checksums to alter the prompt message, modify a response to a Key Distribution Center (KDC) or forge a KRB-SAFE message. (CVE-2010-1323) It was discovered that Kerberos did not properly determine the acceptability of certain checksums. A remote attacker could use certain checksums to forge GSS tokens or gain privileges. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. (CVE-2010-1324) It was discovered that Kerberos did not reject RC4 key-derivation checksums. An authenticated remote user could use this issue to forge AD-SIGNEDPATH or AD-KDC-ISSUED signatures and possibly gain privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4020) It was discovered that Kerberos did not properly restrict the use of TGT credentials for armoring TGS requests. A remote authenticated user could use this flaw to impersonate a client. This issue only affected Ubuntu 9.10. (CVE-2010-4021). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 51116
    published 2010-12-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51116
    title Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : krb5 vulnerabilities (USN-1030-1)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_KRB5-101117.NASL
    description Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software.
    last seen 2019-02-21
    modified 2013-10-25
    plugin id 50974
    published 2010-12-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=50974
    title SuSE 11 / 11.1 Security Update : krb5 (SAT Patch Numbers 3547 / 3549)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2010-18409.NASL
    description This update incorporates the upstream patches to correct bugs outlined in MITKRB5-SA-2010-007 (CVE-2010-1323, CVE-2010-1324, and CVE-2010-4020). Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2016-12-08
    plugin id 51083
    published 2010-12-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=51083
    title Fedora 14 : krb5-1.8.2-7.fc14 (2010-18409)
oval via4
accepted 2015-04-20T04:00:16.386-04:00
class vulnerability
contributors
  • name Varun Narula
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Sushant Kumar Singh
    organization Hewlett-Packard
  • name Prashant Kumar
    organization Hewlett-Packard
  • name Mike Cokus
    organization The MITRE Corporation
description MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys.
family unix
id oval:org.mitre.oval:def:12121
status accepted
submitted 2011-01-31T10:14:52.000-05:00
title HP-UX Running Kerberos, Remote Unauthorized Modification.
version 46
redhat via4
advisories
  • bugzilla
    id 648734
    title CVE-2010-1323 krb5: incorrect acceptance of certain checksums (MITKRB5-SA-2010-007)
    oval
    OR
    • AND
      • comment Red Hat Enterprise Linux 4 is installed
        oval oval:com.redhat.rhsa:tst:20060016001
      • OR
        • AND
          • comment krb5-devel is earlier than 0:1.3.4-62.el4_8.3
            oval oval:com.redhat.rhsa:tst:20100926006
          • comment krb5-devel is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070095007
        • AND
          • comment krb5-libs is earlier than 0:1.3.4-62.el4_8.3
            oval oval:com.redhat.rhsa:tst:20100926002
          • comment krb5-libs is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070095003
        • AND
          • comment krb5-server is earlier than 0:1.3.4-62.el4_8.3
            oval oval:com.redhat.rhsa:tst:20100926004
          • comment krb5-server is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070095009
        • AND
          • comment krb5-workstation is earlier than 0:1.3.4-62.el4_8.3
            oval oval:com.redhat.rhsa:tst:20100926008
          • comment krb5-workstation is signed with Red Hat master key
            oval oval:com.redhat.rhsa:tst:20070095005
    • AND
      • comment Red Hat Enterprise Linux 5 is installed
        oval oval:com.redhat.rhsa:tst:20070055001
      • OR
        • AND
          • comment krb5-devel is earlier than 0:1.6.1-36.el5_5.6
            oval oval:com.redhat.rhsa:tst:20100926017
          • comment krb5-devel is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070095021
        • AND
          • comment krb5-libs is earlier than 0:1.6.1-36.el5_5.6
            oval oval:com.redhat.rhsa:tst:20100926015
          • comment krb5-libs is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070095019
        • AND
          • comment krb5-server is earlier than 0:1.6.1-36.el5_5.6
            oval oval:com.redhat.rhsa:tst:20100926011
          • comment krb5-server is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070095023
        • AND
          • comment krb5-workstation is earlier than 0:1.6.1-36.el5_5.6
            oval oval:com.redhat.rhsa:tst:20100926013
          • comment krb5-workstation is signed with Red Hat redhatrelease key
            oval oval:com.redhat.rhsa:tst:20070095017
    rhsa
    id RHSA-2010:0926
    released 2010-11-30
    severity Moderate
    title RHSA-2010:0926: krb5 security update (Moderate)
  • rhsa
    id RHSA-2010:0925
rpms
  • krb5-devel-0:1.8.2-3.el6_0.3
  • krb5-libs-0:1.8.2-3.el6_0.3
  • krb5-pkinit-openssl-0:1.8.2-3.el6_0.3
  • krb5-server-0:1.8.2-3.el6_0.3
  • krb5-server-ldap-0:1.8.2-3.el6_0.3
  • krb5-workstation-0:1.8.2-3.el6_0.3
  • krb5-devel-0:1.3.4-62.el4_8.3
  • krb5-libs-0:1.3.4-62.el4_8.3
  • krb5-server-0:1.3.4-62.el4_8.3
  • krb5-workstation-0:1.3.4-62.el4_8.3
  • krb5-devel-0:1.6.1-36.el5_5.6
  • krb5-libs-0:1.6.1-36.el5_5.6
  • krb5-server-0:1.6.1-36.el5_5.6
  • krb5-workstation-0:1.6.1-36.el5_5.6
refmap via4
apple APPLE-SA-2011-03-21-1
bid 45118
bugtraq
  • 20101130 MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021]
  • 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console
  • 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console
confirm
debian DSA-2129
fedora
  • FEDORA-2010-18409
  • FEDORA-2010-18425
hp
  • HPSBOV02682
  • HPSBUX02623
  • SSRT100355
  • SSRT100495
mandriva
  • MDVSA-2010:245
  • MDVSA-2010:246
mlist [security-announce] 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console
osvdb 69610
sectrack 1024803
secunia
  • 42399
  • 42420
  • 42436
  • 43015
  • 46397
suse
  • SUSE-SR:2010:023
  • SUSE-SR:2010:024
  • SUSE-SU-2012:0010
  • SUSE-SU-2012:0042
ubuntu USN-1030-1
vupen
  • ADV-2010-3094
  • ADV-2010-3095
  • ADV-2010-3101
  • ADV-2010-3118
  • ADV-2011-0187
Last major update 31-03-2016 - 13:25
Published 02-12-2010 - 11:22
Last modified 10-10-2018 - 15:56
Back to Top