4
CVSSv2

CVE-2017-11368

Published: 09/08/2017 Updated: 07/11/2023
CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8
CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8
VMScore: 356
Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P

Vulnerability Summary

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

fedoraproject fedora 26

fedoraproject fedora 25

mit kerberos 5-1.13.7

mit kerberos 5 1.7

mit kerberos 5 1.7.1

mit kerberos 5 1.8

mit kerberos 5 1.8.1

mit kerberos 5 1.8.2

mit kerberos 5 1.8.3

mit kerberos 5 1.8.4

mit kerberos 5 1.8.5

mit kerberos 5 1.8.6

mit kerberos 5 1.9

mit kerberos 5 1.9.1

mit kerberos 5 1.9.2

mit kerberos 5 1.9.3

mit kerberos 5 1.9.4

mit kerberos 5 1.10

mit kerberos 5 1.10.1

mit kerberos 5 1.10.2

mit kerberos 5 1.10.3

mit kerberos 5 1.10.4

mit kerberos 5 1.11

mit kerberos 5 1.11.1

mit kerberos 5 1.11.2

mit kerberos 5 1.11.3

mit kerberos 5 1.11.4

mit kerberos 5 1.11.5

mit kerberos 5 1.12

mit kerberos 5 1.12.1

mit kerberos 5 1.12.2

mit kerberos 5 1.12.3

mit kerberos 5 1.13

mit kerberos 5 1.13.1

mit kerberos 5 1.13.2

mit kerberos 5 1.13.3

mit kerberos 5 1.13.5

mit kerberos 5 1.13.6

mit kerberos 5 1.14

mit kerberos 5 1.14.1

mit kerberos 5 1.14.2

mit kerberos 5 1.14.3

mit kerberos 5 1.14.4

mit kerberos 5 1.14.5

mit kerberos 5 1.15

mit kerberos 5 1.15.1

Vendor Advisories

Synopsis Moderate: krb5 security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for krb5 is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System ( ...
Debian Bug report logs - #819468 krb5: CVE-2016-3119: null pointer dereference in kadmin Package: src:krb5; Maintainer for src:krb5 is Sam Hartman <hartmans@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 29 Mar 2016 05:15:01 UTC Severity: important Tags: fixed-upstream, patch, security, ...
Debian Bug report logs - #832572 krb5: CVE-2016-3120: Fix S4U2Self KDC crash when anon is restricted Package: src:krb5; Maintainer for src:krb5 is Sam Hartman <hartmans@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 27 Jul 2016 05:48:01 UTC Severity: important Tags: patch, security, ups ...
Debian Bug report logs - #869260 CVE-2017-11368 Package: src:krb5; Maintainer for src:krb5 is Sam Hartman <hartmans@debianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Sat, 22 Jul 2017 06:42:01 UTC Severity: grave Tags: fixed-upstream, security, upstream Found in version krb5/1101+dfsg-5 Fixed in v ...
Debian Bug report logs - #783557 CVE-2015-2694 in krb5-otp, krb5-pkinit Package: src:krb5; Maintainer for src:krb5 is Sam Hartman <hartmans@debianorg>; Reported by: Benjamin Kaduk <kaduk@MITEDU> Date: Mon, 27 Apr 2015 22:39:02 UTC Severity: normal Tags: fixed-upstream, security, upstream Found in version krb5/112 ...
Authentication bypass by improper validation of certificate EKU and SANAn authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstanc ...
A denial of service flaw was found in MIT Kerberos krb5kdc service An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request(CVE-2017-11368) An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certifi ...
A denial of service flaw was found in MIT Kerberos krb5kdc service An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request ...
A denial of service flaw was found in MIT Kerberos krb5kdc service An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request ...