#VU12181 Authentication bypass in Kerberos 5 - CVE-2017-7562
Published: April 25, 2018
Vulnerability identifier: #VU12181
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-7562
CWE-ID: CWE-592
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Kerberos 5
Kerberos 5
Software vendor:
MIT
MIT
Description
The vulnerability allows a remote authenticated attacker to write arbitrary files on the target system.
The weakness exists due to an authentication bypass in the way krb5's certauth interface handled the validation of client certificates. A remote attacker can impersonate arbitrary principals under rare and erroneous circumstances.
The weakness exists due to an authentication bypass in the way krb5's certauth interface handled the validation of client certificates. A remote attacker can impersonate arbitrary principals under rare and erroneous circumstances.
Remediation
Install update from vendor's website.