VulnerabilityModified

CVE-2010-1321

MEDIUM 6.8EPSS 6.88%

Does this matter?

Lower severity and a low EPSS score (6.88%). Track it; it rarely justifies an emergency change on its own.

Description

The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing.

CVSS 2.0: 6.8 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:C
EPSS: 6.88% probability · 94th percentile
CISA KEV: Not listed
Weakness: CWE-476
Affected: mit/kerberos 5 · debian/debian linux · canonical/ubuntu linux · oracle/database server · opensuse/opensuse · suse/linux enterprise server · fedoraproject/fedora
Source: cve@mitre.org

References

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041615.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041645.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041654.htmlThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.htmlMailing List, Third Party Advisory
http://marc.info/?l=bugtraq&m=134254866602253&w=2Issue Tracking, Third Party Advisory
http://osvdb.org/64744Broken Link
http://secunia.com/advisories/39762Third Party Advisory
http://secunia.com/advisories/39784Third Party Advisory
http://secunia.com/advisories/39799Third Party Advisory
http://secunia.com/advisories/39818Third Party Advisory
http://secunia.com/advisories/39849Third Party Advisory
http://secunia.com/advisories/40346Third Party Advisory
http://secunia.com/advisories/40685Third Party Advisory
http://secunia.com/advisories/41967Third Party Advisory
http://secunia.com/advisories/42432Third Party Advisory
http://secunia.com/advisories/42974Third Party Advisory
http://secunia.com/advisories/43335Third Party Advisory
http://secunia.com/advisories/44954Third Party Advisory
http://support.avaya.com/css/P8/documents/100114315Third Party Advisory
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-005.txtPatch, Vendor Advisory
http://www.debian.org/security/2010/dsa-2052Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2010:100Third Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpujuly2011-313328.htmlThird Party Advisory
http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.htmlThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.