certfr_avis - certa-2011-avi-595

CERTA-2011-AVI-595

Vulnerability from certfr_avis

Plusieurs vulnérabilités de MIT Kerberos permettent à un utilisateur non authentifié de provoquer un déni de service à distance.

Description

Dans MIT Kerberos, plusieurs vulnérabilités permettent à un utilisateur non authentifié de provoquer l'arrêt inopiné du serveur KDC.

L'une de ces vulnérabilités est générale. Les autres ne sont exploitables que si le KDC est adossé à un annuaire LDAP ou à une base de donnée Berkeley.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

MIT Kerberos krb5-1.8 et krb5-1.9.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité MIT Kerberos MITKRB5-SA-2011-006 du 22 octobre 2011	None	vendor-advisory
Bulletin de sécurité Ubunutu USN-1233 du 18 octobre 2011 :	-	other
Bulletin de sécurité MIT Kerberos MITKRB5-SA-2011-006 du 22 octobre 2011 :	-	other
Bulletin de sécurité Mandriva MDVSA-2011:159 du 22 octobre 2011 :	-	other
Bulletin de sécurité Mandriva MDVSA-2011:160 du 22 octobre 2011 :	-	other
Bulletin de sécurité RedHat RHSA-2011:1379-1 du 18 octobre 2011 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cp\u003eMIT Kerberos krb5-1.8 et krb5-1.9.\u003c/p\u003e",
  "content": "## Description\n\nDans MIT Kerberos, plusieurs vuln\u00e9rabilit\u00e9s permettent \u00e0 un utilisateur\nnon authentifi\u00e9 de provoquer l\u0027arr\u00eat inopin\u00e9 du serveur KDC.\n\nL\u0027une de ces vuln\u00e9rabilit\u00e9s est g\u00e9n\u00e9rale. Les autres ne sont\nexploitables que si le KDC est adoss\u00e9 \u00e0 un annuaire LDAP ou \u00e0 une base\nde donn\u00e9e Berkeley.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2011-1529",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1529"
    },
    {
      "name": "CVE-2011-4151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-4151"
    },
    {
      "name": "CVE-2011-1527",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1527"
    },
    {
      "name": "CVE-2011-1528",
      "url": "https://www.cve.org/CVERecord?id=CVE-2011-1528"
    }
  ],
  "initial_release_date": "2011-10-26T00:00:00",
  "last_revision_date": "2011-10-26T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ubunutu USN-1233 du 18 octobre 2011 :",
      "url": "http://www.ubuntu.com/usn/usn-1233-1/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 MIT Kerberos MITKRB5-SA-2011-006 du 22    octobre 2011 :",
      "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDVSA-2011:159 du 22 octobre    2011 :",
      "url": "http://www.mandriva.com/fr/support/security/advisories?name=MDVSA-2011:159"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandriva MDVSA-2011:160 du 22 octobre    2011 :",
      "url": "http://www.mandriva.com/fr/support/security/advisories?name=MDVSA-2011:160"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 RedHat RHSA-2011:1379-1 du 18 octobre    2011 :",
      "url": "http://rhn.redhat.com/errata/RHSA-2011-1379.html"
    }
  ],
  "reference": "CERTA-2011-AVI-595",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2011-10-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s de MIT Kerberos permettent \u00e0 un utilisateur non\nauthentifi\u00e9 de provoquer un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans MIT Kerberos",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 MIT Kerberos MITKRB5-SA-2011-006 du 22 octobre 2011",
      "url": null
    }
  ]
}

CVE-2011-1529 (GCVE-0-2011-1529)

Vulnerability from cvelistv5

Published

2011-10-20 21:00

Modified

2024-08-06 22:28

Severity ?

CWE

Summary

The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.

References

URL

Tags

	http://www.mandriva.com/security/advisories?name=MDVSA-2011:159	vendor-advisory, x_refsource_MANDRIVA
	http://www.mandriva.com/security/advisories?name=MDVSA-2011:160	vendor-advisory, x_refsource_MANDRIVA
	http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html	vendor-advisory, x_refsource_SUSE
	http://www.kb.cert.org/vuls/id/659251	third-party-advisory, x_refsource_CERT-VN
	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2011-1379.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:28:41.834Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MDVSA-2011:159",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
          },
          {
            "name": "MDVSA-2011:160",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:160"
          },
          {
            "name": "openSUSE-SU-2011:1169",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html"
          },
          {
            "name": "VU#659251",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/659251"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
          },
          {
            "name": "RHSA-2011:1379",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-10-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-10-26T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "MDVSA-2011:159",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
        },
        {
          "name": "MDVSA-2011:160",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:160"
        },
        {
          "name": "openSUSE-SU-2011:1169",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html"
        },
        {
          "name": "VU#659251",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/659251"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
        },
        {
          "name": "RHSA-2011:1379",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-1529",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MDVSA-2011:159",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
            },
            {
              "name": "MDVSA-2011:160",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:160"
            },
            {
              "name": "openSUSE-SU-2011:1169",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html"
            },
            {
              "name": "VU#659251",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/659251"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
            },
            {
              "name": "RHSA-2011:1379",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-1529",
    "datePublished": "2011-10-20T21:00:00",
    "dateReserved": "2011-03-29T00:00:00",
    "dateUpdated": "2024-08-06T22:28:41.834Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-1528 (GCVE-0-2011-1528)

Vulnerability from cvelistv5

Published

2011-10-20 21:00

Modified

2024-08-06 22:28

Severity ?

CWE

Summary

The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, related to the locked_check_p function. NOTE: the Berkeley DB vector is covered by CVE-2011-4151.

References

URL

Tags

	http://www.mandriva.com/security/advisories?name=MDVSA-2011:159	vendor-advisory, x_refsource_MANDRIVA
	http://www.mandriva.com/security/advisories?name=MDVSA-2011:160	vendor-advisory, x_refsource_MANDRIVA
	http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html	vendor-advisory, x_refsource_SUSE
	https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/715579	x_refsource_CONFIRM
	http://www.kb.cert.org/vuls/id/659251	third-party-advisory, x_refsource_CERT-VN
	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2011-1379.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:28:41.827Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "MDVSA-2011:159",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
          },
          {
            "name": "MDVSA-2011:160",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:160"
          },
          {
            "name": "openSUSE-SU-2011:1169",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/715579"
          },
          {
            "name": "VU#659251",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/659251"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
          },
          {
            "name": "RHSA-2011:1379",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-10-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, related to the locked_check_p function.  NOTE: the Berkeley DB vector is covered by CVE-2011-4151."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-10-26T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "MDVSA-2011:159",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
        },
        {
          "name": "MDVSA-2011:160",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:160"
        },
        {
          "name": "openSUSE-SU-2011:1169",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/715579"
        },
        {
          "name": "VU#659251",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/659251"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
        },
        {
          "name": "RHSA-2011:1379",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-1528",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, related to the locked_check_p function.  NOTE: the Berkeley DB vector is covered by CVE-2011-4151."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "MDVSA-2011:159",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
            },
            {
              "name": "MDVSA-2011:160",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:160"
            },
            {
              "name": "openSUSE-SU-2011:1169",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html"
            },
            {
              "name": "https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/715579",
              "refsource": "CONFIRM",
              "url": "https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/715579"
            },
            {
              "name": "VU#659251",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/659251"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
            },
            {
              "name": "RHSA-2011:1379",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-1528",
    "datePublished": "2011-10-20T21:00:00",
    "dateReserved": "2011-03-29T00:00:00",
    "dateUpdated": "2024-08-06T22:28:41.827Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-1527 (GCVE-0-2011-1527)

Vulnerability from cvelistv5

Published

2011-10-20 21:00

Modified

2024-08-06 22:28

Severity ?

CWE

Summary

The kdb_ldap plugin in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions.

References

URL

Tags

	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629558	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDVSA-2011:159	vendor-advisory, x_refsource_MANDRIVA
	http://www.kb.cert.org/vuls/id/659251	third-party-advisory, x_refsource_CERT-VN
	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2011-1379.html	vendor-advisory, x_refsource_REDHAT

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T22:28:41.799Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629558"
          },
          {
            "name": "MDVSA-2011:159",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
          },
          {
            "name": "VU#659251",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/659251"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
          },
          {
            "name": "RHSA-2011:1379",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-10-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The kdb_ldap plugin in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2011-10-26T09:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629558"
        },
        {
          "name": "MDVSA-2011:159",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
        },
        {
          "name": "VU#659251",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/659251"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
        },
        {
          "name": "RHSA-2011:1379",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-1527",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The kdb_ldap plugin in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629558",
              "refsource": "CONFIRM",
              "url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629558"
            },
            {
              "name": "MDVSA-2011:159",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:159"
            },
            {
              "name": "VU#659251",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/659251"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
            },
            {
              "name": "RHSA-2011:1379",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2011-1379.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-1527",
    "datePublished": "2011-10-20T21:00:00",
    "dateReserved": "2011-03-29T00:00:00",
    "dateUpdated": "2024-08-06T22:28:41.799Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2011-4151 (GCVE-0-2011-4151)

Vulnerability from cvelistv5

Published

2011-10-20 21:00

Modified

2024-08-07 00:01

Severity ?

CWE

Summary

The krb5_db2_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4, when the db2 (aka Berkeley DB) back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, a different vulnerability than CVE-2011-1528.

References

URL

Tags

	http://www.kb.cert.org/vuls/id/659251	third-party-advisory, x_refsource_CERT-VN
	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/70891	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T00:01:51.160Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "VU#659251",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/659251"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
          },
          {
            "name": "mit-kerberos-krb5db2lockoutaudit-dos(70891)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70891"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2011-10-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The krb5_db2_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4, when the db2 (aka Berkeley DB) back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, a different vulnerability than CVE-2011-1528."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "VU#659251",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/659251"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
        },
        {
          "name": "mit-kerberos-krb5db2lockoutaudit-dos(70891)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70891"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2011-4151",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The krb5_db2_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4, when the db2 (aka Berkeley DB) back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, a different vulnerability than CVE-2011-1528."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "VU#659251",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/659251"
            },
            {
              "name": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt"
            },
            {
              "name": "mit-kerberos-krb5db2lockoutaudit-dos(70891)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70891"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2011-4151",
    "datePublished": "2011-10-20T21:00:00",
    "dateReserved": "2011-10-20T00:00:00",
    "dateUpdated": "2024-08-07T00:01:51.160Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTA-2011-AVI-595

Vulnerability from certfr_avis

Description

Solution

CVE-2011-1529 (GCVE-0-2011-1529)

Vulnerability from cvelistv5

CVE-2011-1528 (GCVE-0-2011-1528)

Vulnerability from cvelistv5

CVE-2011-1527 (GCVE-0-2011-1527)

Vulnerability from cvelistv5

CVE-2011-4151 (GCVE-0-2011-4151)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature