SB2015120917 - Ubuntu update for krb5

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015120917

SB2015120917 - Ubuntu update for krb5

Published: December 9, 2015 Updated: October 30, 2026

Security Bulletin ID SB2015120917
CSH Severity
High
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Cryptographic issues (CVE-ID: CVE-2010-1323)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to escalate privileges on the target system.

The vulnerability exists due to MIT Kerberos 5 does not properly determine the acceptability of checksums. A remote attacker can modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that are unkeyed or use RC4 keys.


2) Cryptographic issues (CVE-ID: CVE-2010-1324)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to modify files on the system.

The vulnerability exists due to MIT Kerberos 5 does not properly determine the acceptability of checksums. A remote attacker can forge GSS tokens, gain privileges, or have unspecified other impact via an unkeyed checksum, an unkeyed PAC checksum, or a KrbFastArmoredReq checksum based on an RC4 key.


3) Cryptographic issues (CVE-ID: CVE-2010-4020)

CWE-ID: CWE-310 - Cryptographic Issues

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to MIT Kerberos 5 does not reject RC4 key-derivation checksums. A remote user can forge a AD-SIGNEDPATH or AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations.


4) Configuration (CVE-ID: CVE-2010-4021)

CWE-ID: CWE-16 - Configuration

CVSSv4: 1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify files on the system.

The vulnerability exists due to MIT Kerberos 5 does not properly restrict the use of TGT credentials for armoring TGS requests. A remote authenticated user can impersonate a client by rewriting an inner request, aka a KrbFastReq forgery issue.


Remediation

Install update from vendor's website.

References