Authentication bypass in Kerberos 5 - CVE-2017-7562
Published: April 25, 2018
Vulnerability identifier: #VU12181
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-7562
CWE-ID: CWE-592
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: MIT
Affected software:
Kerberos 5
Kerberos 5
Detailed vulnerability description
The vulnerability allows a remote authenticated attacker to write arbitrary files on the target system.
The weakness exists due to an authentication bypass in the way krb5's certauth interface handled the validation of client certificates. A remote attacker can impersonate arbitrary principals under rare and erroneous circumstances.
The weakness exists due to an authentication bypass in the way krb5's certauth interface handled the validation of client certificates. A remote attacker can impersonate arbitrary principals under rare and erroneous circumstances.
How to mitigate CVE-2017-7562
Install update from vendor's website.