CVE-2010-1323 MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visib...
LowCVSS 3.7
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos | = 5-1.5.4 | No fix listed |
| mit kerberos 5 | = 1.3 | No fix listed |
| mit kerberos 5 | = 1.3-alpha1 | No fix listed |
| mit kerberos 5 | = 1.3.1 | No fix listed |
| mit kerberos 5 | = 1.3.2 | No fix listed |
| mit kerberos 5 | = 1.3.3 | No fix listed |
| mit kerberos 5 | = 1.3.4 | No fix listed |
| mit kerberos 5 | = 1.3.5 | No fix listed |
| mit kerberos 5 | = 1.3.6 | No fix listed |
| mit kerberos 5 | = 1.4 | No fix listed |
| mit kerberos 5 | = 1.4.1 | No fix listed |
| mit kerberos 5 | = 1.4.2 | No fix listed |
| mit kerberos 5 | = 1.4.3 | No fix listed |
| mit kerberos 5 | = 1.4.4 | No fix listed |
| mit kerberos 5 | = 1.5 | No fix listed |
| mit kerberos 5 | = 1.5.1 | No fix listed |
| mit kerberos 5 | = 1.5.2 | No fix listed |
| mit kerberos 5 | = 1.5.3 | No fix listed |
| mit kerberos 5 | = 1.6 | No fix listed |
| mit kerberos 5 | = 1.6.1 | No fix listed |
| mit kerberos 5 | = 1.6.2 | No fix listed |
| mit kerberos 5 | = 1.7 | No fix listed |
| mit kerberos 5 | = 1.7.1 | No fix listed |
| mit kerberos 5 | = 1.8 | No fix listed |
| mit kerberos 5 | = 1.8.1 | No fix listed |
Show 5 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos 5 | = 1.8.2 | No fix listed |
| mit kerberos 5 | = 1.8.3 | No fix listed |
| debian/krb5(Debian:12) | < 1.8.3+dfsg-3 | 1.8.3+dfsg-3 |
| debian/krb5(Debian:13) | < 1.8.3+dfsg-3 | 1.8.3+dfsg-3 |
| debian/krb5(Debian:14) | < 1.8.3+dfsg-3 | 1.8.3+dfsg-3 |
References
- kb.vmware.com
- APPLE-SA-2011-03-21-1 vendor-advisory
- FEDORA-2010-18409 vendor-advisory
- FEDORA-2010-18425 vendor-advisory
- SUSE-SR:2010:023 vendor-advisory
- SUSE-SR:2010:024 vendor-advisory
- SUSE-SU-2012:0010 vendor-advisory
- SUSE-SU-2012:0042 vendor-advisory
- [security-announce] 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console mailing-list
- HPSBUX02623 vendor-advisory
- SSRT100495 vendor-advisory
- 69610 vdb-entry
- 42399 third-party-advisory vendor-advisory
- 42420 third-party-advisory
- 42436 third-party-advisory
- 43015 third-party-advisory
- 46397 third-party-advisory
- support.apple.com
- web.mit.edu vendor-advisory
- DSA-2129 vendor-advisory
- MDVSA-2010:245 vendor-advisory
- MDVSA-2010:246 vendor-advisory
- www.oracle.com patch vendor-advisory
- RHSA-2010:0925 vendor-advisory
- RHSA-2010:0926 vendor-advisory
- 20101130 MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021] mailing-list
- 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console mailing-list
- 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console mailing-list
- 45118 vdb-entry
- 1024803 vdb-entry
- USN-1030-1 vendor-advisory
- www.vmware.com
- www.vmware.com
- ADV-2010-3094 vdb-entry
- ADV-2010-3095 vdb-entry
- ADV-2010-3101 vdb-entry
- ADV-2010-3118 vdb-entry
- ADV-2011-0187 vdb-entry
- oval:org.mitre.oval:def:12121 signature vdb-entry
- Debian Security Tracker CVE-2010-1323 vendor-advisory
- bugs.debian.org issue-tracking