2.6
CVSSv2

CVE-2010-1323

Published: 02/12/2010 Updated: 21/01/2020
CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9
CVSS v3 Base Score: 3.7 | Impact Score: 1.4 | Exploitability Score: 2.2
VMScore: 231
Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N

Vulnerability Summary

MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x up to and including 1.8.3 does not properly determine the acceptability of checksums, which might allow remote malicious users to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys.

Vulnerable Product Search on Vulmon Subscribe to Product

mit kerberos 5-1.5.4

mit kerberos 5 1.3

mit kerberos 5 1.3.1

mit kerberos 5 1.3.2

mit kerberos 5 1.3.3

mit kerberos 5 1.3.4

mit kerberos 5 1.3.5

mit kerberos 5 1.3.6

mit kerberos 5 1.4

mit kerberos 5 1.4.1

mit kerberos 5 1.4.2

mit kerberos 5 1.4.3

mit kerberos 5 1.4.4

mit kerberos 5 1.5

mit kerberos 5 1.5.1

mit kerberos 5 1.5.2

mit kerberos 5 1.5.3

mit kerberos 5 1.6

mit kerberos 5 1.6.1

mit kerberos 5 1.6.2

mit kerberos 5 1.7

mit kerberos 5 1.7.1

mit kerberos 5 1.8

mit kerberos 5 1.8.1

mit kerberos 5 1.8.2

mit kerberos 5 1.8.3

Vendor Advisories

A vulnerability has been found in krb5, the MIT implementation of Kerberos MIT krb5 clients incorrectly accept unkeyed checksums in the SAM-2 preauthentication challenge: an unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC Under some circumstances, th ...
It was discovered that Kerberos did not properly determine the acceptability of certain checksums A remote attacker could use certain checksums to alter the prompt message, modify a response to a Key Distribution Center (KDC) or forge a KRB-SAFE message (CVE-2010-1323) ...
Oracle Critical Patch Update Advisory - July 2015 Description A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities Critical Patch Update patches are usually cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory Thus, prior Critical Patch U ...

Github Repositories

nopc

nopc NOPC, the Nessus-based offline UNIX patch checker Note: This is not an actively maintained script Prerequisites To run the nopcsh script, the script needs to be on system that contains both the nasl command and plugins from nessus The usual case is for nopcsh to be run on a unix build that has Nessus install Usage The following are optional parameters: -d ‘ness

References

CWE-310http://kb.vmware.com/kb/1035108http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.htmlhttp://lists.vmware.com/pipermail/security-announce/2011/000133.htmlhttp://marc.info/?l=bugtraq&m=129562442714657&w=2http://marc.info/?l=bugtraq&m=130497213107107&w=2http://osvdb.org/69610http://secunia.com/advisories/42399http://secunia.com/advisories/42420http://secunia.com/advisories/42436http://secunia.com/advisories/43015http://secunia.com/advisories/46397http://support.apple.com/kb/HT4581http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txthttp://www.debian.org/security/2010/dsa-2129http://www.mandriva.com/security/advisories?name=MDVSA-2010:245http://www.mandriva.com/security/advisories?name=MDVSA-2010:246http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0925.htmlhttp://www.redhat.com/support/errata/RHSA-2010-0926.htmlhttp://www.securityfocus.com/archive/1/514953/100/0/threadedhttp://www.securityfocus.com/archive/1/517739/100/0/threadedhttp://www.securityfocus.com/archive/1/520102/100/0/threadedhttp://www.securityfocus.com/bid/45118http://www.securitytracker.com/id?1024803http://www.ubuntu.com/usn/USN-1030-1http://www.vmware.com/security/advisories/VMSA-2011-0007.htmlhttp://www.vmware.com/security/advisories/VMSA-2011-0012.htmlhttp://www.vupen.com/english/advisories/2010/3094http://www.vupen.com/english/advisories/2010/3095http://www.vupen.com/english/advisories/2010/3101http://www.vupen.com/english/advisories/2010/3118http://www.vupen.com/english/advisories/2011/0187https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12121https://www.rapid7.com/db/vulnerabilities/vmsa-2011-0012-cve-2010-1323http://tools.cisco.com/security/center/viewAlert.x?alertId=21933https://nvd.nist.govhttps://usn.ubuntu.com/1030-1/https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2010-0926