Lucene search

K
centosCentOS ProjectCESA-2011:1790
HistoryDec 22, 2011 - 3:48 p.m.

krb5 security update

2011-12-2215:48:45
CentOS Project
lists.centos.org
51

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

6.5 Medium

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

86.0%

CentOS Errata and Security Advisory CESA-2011:1790

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other using symmetric encryption and a
trusted third-party, the Key Distribution Center (KDC).

A NULL pointer dereference flaw was found in the way the MIT Kerberos KDC
processed certain TGS (Ticket-granting Server) requests. A remote,
authenticated attacker could use this flaw to crash the KDC via a
specially-crafted TGS request. (CVE-2011-1530)

Red Hat would like to thank the MIT Kerberos project for reporting this
issue.

All krb5 users should upgrade to these updated packages, which contain a
backported patch to correct this issue. After installing the updated
packages, the krb5kdc daemon will be restarted automatically.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2011-December/080506.html

Affected packages:
krb5-devel
krb5-libs
krb5-pkinit-openssl
krb5-server
krb5-server-ldap
krb5-workstation

Upstream details at:
https://access.redhat.com/errata/RHSA-2011:1790

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:N/I:N/A:C

6.5 Medium

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

86.0%