PRIOn knowledge basePRION:CVE-2017-11368Authentication flaw
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.3 Medium
AI Score
Confidence
High
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
58.2%
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.
| CPE | Name | Operator | Version |
|---|---|---|---|
| fedora | eq | 26 | |
| fedora | eq | 25 | |
| kerberos | eq | 5.0.1137 | |
| kerberos_5 | eq | 1.7 | |
| kerberos_5 | eq | 1.7.1 | |
| kerberos_5 | eq | 1.8 | |
| kerberos_5 | eq | 1.8.1 | |
| kerberos_5 | eq | 1.8.2 | |
| kerberos_5 | eq | 1.8.3 | |
| kerberos_5 | eq | 1.8.4 |
References
www.securityfocus.com/bid/100291
access.redhat.com/errata/RHSA-2018:0666
github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970
lists.fedoraproject.org/archives/list/[email protected]/message/4HNWXM6OQU7G23MG7XWIOBRGP43ECLDT/
lists.fedoraproject.org/archives/list/[email protected]/message/UBUTXMNZWMVJLQ4NDX5OQFPUVCJRLV3W/
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6.3 Medium
AI Score
Confidence
High
4 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:N/I:N/A:P
0.002 Low
EPSS
Percentile
58.2%