SB2012060704 - Multiple vulnerabilities in MIT Kerberos 5

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012060704

SB2012060704 - Multiple vulnerabilities in MIT Kerberos 5

Published: June 7, 2012 Updated: May 27, 2022

Security Bulletin ID SB2012060704
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-1012)

The vulnerability allows a remote #AU# to read and manipulate data.

server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege.


2) Input validation error (CVE-ID: CVE-2012-1013)

The vulnerability allows remote authenticated administrators to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password.


Remediation

Install update from vendor's website.

References