CVSS: 7.5EPSS: 10%CPEs: 11EXPL: 0CVE-2011-0282 – krb5: KDC crash when using LDAP backend caused by a special principal name (MITKRB5-SA-2011-002)
https://notcve.org/view.php?id=CVE-2011-0282
10 Feb 2011 — The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read, and daemon crash) via a crafted principal name. El Key Distribution Center (KDC) en MIT Kerberos 5 (también conocido como krb5) v1.6.x hasta v1.9 cuando un se utiliza un backend LDAP, permite a atacantes remotos provocar una denegación de servicio (desreferencia a puntero nulo o sobre-lectura, y caí... • http://lists.opensuse.org/opensuse-security-announce/2011-02/msg00004.html •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2011-0283
https://notcve.org/view.php?id=CVE-2011-0283
10 Feb 2011 — The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed request packet that does not trigger a response packet. El Key Distribution Center (KDC) en MIT Kerberos 5 (también conocido como krb5) v1.9, permite a atacantes remotos provocar una denegación de servicio (desreferencia a puntero nulo y caída de demonio) a través de un paquete de solicitud con formato incorrecto que no activa un ... • http://secunia.com/advisories/43260 •
CVSS: 6.3EPSS: 0%CPEs: 4EXPL: 0CVE-2010-4020 – krb5: krb5 may accept authdata checksums with low-entropy derived keys (MITKRB5-SA-2010-007)
https://notcve.org/view.php?id=CVE-2010-4020
02 Dec 2010 — MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations. MIT Kerberos 5 (también conocido como krb5) v1.8.x hasta v1.8.3 no rechaza las sumas de comprobación RC4 (clave de derivación), lo que podría permitir a usuarios remotos autenticados falsif... • http://kb.vmware.com/kb/1035108 • CWE-310: Cryptographic Issues •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2010-4021
https://notcve.org/view.php?id=CVE-2010-4021
02 Dec 2010 — The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS requests, which might allow remote authenticated users to impersonate a client by rewriting an inner request, aka a "KrbFastReq forgery issue." El Centro de distribución de claves (KDC) en MIT Kerberos 5 (también conocido como krb5) v1.7 no restringe correctamente el uso de credenciales TGT para proteger solicitudes TGS, lo que podría permitir a usuarios remotos autentica... • http://kb.vmware.com/kb/1035108 • CWE-16: Configuration CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.7EPSS: 4%CPEs: 27EXPL: 0CVE-2010-1323 – krb5: incorrect acceptance of certain checksums (MITKRB5-SA-2010-007)
https://notcve.org/view.php?id=CVE-2010-1323
02 Dec 2010 — MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys. MIT Kerberos 5 (también conocido como krb5) v1.3.x, v1.4.x, v1.5.x, v1.6.x, v1.7.x, y v1.8.x hasta v1.8.3 no determina correctamente la aceptabilidad ... • http://kb.vmware.com/kb/1035108 • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 3%CPEs: 6EXPL: 0CVE-2010-1324 – krb5: multiple checksum handling vulnerabilities (MITKRB5-SA-2010-007)
https://notcve.org/view.php?id=CVE-2010-1324
02 Dec 2010 — MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key. MIT Kerberos 5 (también conocido como krb5) v1.7.x y v1.8.x hasta v1.8.3 no determina correctamente la aceptabilidad de las sumas de comprobación, lo que podría permitir a un ... • http://kb.vmware.com/kb/1035108 • CWE-310: Cryptographic Issues •
CVSS: 9.1EPSS: 1%CPEs: 4EXPL: 0CVE-2010-1322 – krb5: KDC uninitialized pointer crash in authorization data handling (MITKRB5-SA-2010-006)
https://notcve.org/view.php?id=CVE-2010-1322
07 Oct 2010 — The merge_authdata function in kdc_authdata.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x before 1.8.4 does not properly manage an index into an authorization-data list, which allows remote attackers to cause a denial of service (daemon crash), or possibly obtain sensitive information, spoof authorization, or execute arbitrary code, via a TGS request that triggers an uninitialized pointer dereference, as demonstrated by a request from a Windows Active Directory client. La función... • http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 2%CPEs: 20EXPL: 0CVE-2010-1321 – krb5: null pointer dereference in GSS-API library leads to DoS (MITKRB5-SA-2010-005)
https://notcve.org/view.php?id=CVE-2010-1321
19 May 2010 — The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator's checksum field is missing. Vulnerabilidad en la función "kg_accept_krb5" en "krb5/accept_sec_context.c" de l... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427 • CWE-476: NULL Pointer Dereference •
CVSS: 8.8EPSS: 14%CPEs: 4EXPL: 2CVE-2010-1320 – MIT Kerberos 5 - 'src/kdc/do_tgs_req.c' Ticket Renewal Double-Free Memory Corruption
https://notcve.org/view.php?id=CVE-2010-1320
22 Apr 2010 — Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with (1) renewal or (2) validation. Una doble vulnerabilidad en do_tgs_req.c en el Centro de distribución de claves (KDC) en MIT Kerberos 5 (también conocido como krb5) versiones v1.7.x y v1.8.x antes de v1.8.2 permite a los usuarios rem... • https://www.exploit-db.com/exploits/33855 • CWE-399: Resource Management Errors •
CVSS: 6.5EPSS: 2%CPEs: 8EXPL: 1CVE-2010-0629 – krb5: kadmind use-after-free remote crash (MITKRB5-SA-2010-003)
https://notcve.org/view.php?id=CVE-2010-0629
07 Apr 2010 — Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number. Vulnerabilidad de uso después de la liberación kadmin/server/server_stubs.c en kadmind en MIT Kerberos 5 (también conocido como krb5) de la v1.5 a la v1.6.3, permite a usuarios autenticados remotamente provocar una denegación de servicio ... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567052 • CWE-416: Use After Free •