Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntucveUbuntu.comUB:CVE-2010-4020
HistoryDec 02, 2010 - 12:00 a.m.

CVE-2010-4020

2010-12-0200:00:00
ubuntu.com
ubuntu.com
8

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

64.4%

JSON

MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4
key-derivation checksums, which might allow remote authenticated users to
forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain
privileges, by leveraging the small key space that results from certain
one-byte stream-cipher operations.

Bugs

Notes

Author Note
mdeslaur 1.8 and newer
OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchkrb5< 1.8.1+dfsg-2ubuntu0.4UNKNOWN
ubuntu10.10noarchkrb5< 1.8.1+dfsg-5ubuntu0.2UNKNOWN

Related

openvas 25
debiancve 1
prion 1
nessus 19
cve 1
freebsd 1
redhat 1
fedora 6
ubuntu 1
securityvulns 5
oraclelinux 1
vmware 1
ibm 1
gentoo 1
oracle 1
openvas
openvas
FreeBSD Ports: krb5
2011-01-24 00:00:00
FreeBSD Ports: krb5
2011-01-24 00:00:00
Fedora Update for krb5 FEDORA-2010-18409
2010-12-23 00:00:00
debiancve
debiancve
CVE-2010-4020
2010-12-02 16:22:00
prion
prion
Design/Logic Flaw
2010-12-02 16:22:00
nessus
nessus
FreeBSD : krb5 -- RFC 3961 key-derivation checksum handling vulnerability (1d193bba-03f6-11e0-bf50-001a926c7637)
2010-12-10 00:00:00
RHEL 6 : krb5 (RHSA-2010:0925)
2010-12-01 00:00:00
Fedora 13 : krb5-1.7.1-16.fc13 (2010-18425)
2010-12-10 00:00:00
cve
cve
CVE-2010-4020
2010-12-02 16:22:00
freebsd
freebsd
krb5 -- RFC 3961 key-derivation checksum handling vulnerability
2010-11-30 00:00:00
redhat
redhat
(RHSA-2010:0925) Important: krb5 security and bug fix update
2010-11-30 00:00:00
fedora
fedora
[SECURITY] Fedora 14 Update: krb5-1.8.2-7.fc14
2010-12-08 21:41:21
[SECURITY] Fedora 13 Update: krb5-1.7.1-16.fc13
2010-12-09 21:57:48
[SECURITY] Fedora 14 Update: krb5-1.8.2-8.fc14
2011-02-18 01:52:10
ubuntu
ubuntu
Kerberos vulnerabilities
2010-12-09 00:00:00
securityvulns
securityvulns
MIT Kerberos 5 multiple checksum vulnerabilities
2010-12-01 00:00:00
MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021]
2010-12-01 00:00:00
VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console
2011-05-02 00:00:00
oraclelinux
oraclelinux
krb5 security update
2011-02-10 00:00:00
vmware
vmware
VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console
2011-04-28 00:00:00
ibm
ibm
Security Bulletin: Multiple security vulnerabilities found in open source code that is shipped with IBM Security Verify Access
2022-07-06 18:27:44
gentoo
gentoo
MIT Kerberos 5: Multiple vulnerabilities
2012-01-23 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2015
2015-07-14 00:00:00

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

64.4%

JSON
Related for UB:CVE-2010-4020
openvas25debiancve1prion1nessus19cve1freebsd1redhat1fedora6ubuntu1securityvulns5oraclelinux1vmware1ibm1gentoo1oracle1