Vulnerability Details : CVE-2010-0283

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2, and 1.8 alpha, allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid (1) AS-REQ or (2) TGS-REQ request.
Publish Date : 2010-02-22 Last Update Date : 2010-06-19

Collapse All Expand All Select Select&Copy	Scroll To Vendor Statements(0) Additional Vendor Data(0) OVAL Definitions(0) Vulnerable Products(0) # Of Vulns By Products References(0) Metasploit Modules(0)	Comments View User Comments Add Comment	External Links Secunia Advisories XForce Advisories Vulnerability Details at NVD Vulnerability Details at Mitre Nessus Plugins Linux Kernel Git Repository First CVSS Guide
Search Twitter Search YouTube Search Google

- CVSS Scores & Vulnerability Types

CVSS Score	7.8
Confidentiality Impact	None (There is no impact to the confidentiality of the system.)
Integrity Impact	None (There is no impact to the integrity of the system)
Availability Impact	Complete (There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.)
Access Complexity	Low (Specialized access conditions or extenuating circumstances do not exist. Very little knowledge or skill is required to exploit. )
Authentication	Not required (Authentication is not required to exploit the vulnerability.)
Gained Access	None
Vulnerability Type(s)	Denial Of Service
CWE ID	20

- Vendor Statements

Not vulnerable. This issue did not affect the versions of MIT Kerberos 5 as shipped with Red Hat Enterprise Linux 3, 4 or 5. Those versions do not contain the vulnerable code that was introduced in krb5 1.7.
Source: Redhat

- Related OVAL Definitions

Title	Definition Id	Class	Family
CVE-2010-0283	oval:org.opensuse.security:def:20100283		unix

OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify a vulnerability or a missing patch. Check out the OVAL definitions if you want to learn what you should do to verify a vulnerability.

- Products Affected By CVE-2010-0283

#	Product Type	Vendor	Product	Version	Update
1	Application	MIT	Kerberos	5-1.7		Version Details Vulnerabilities
2	Application	MIT	Kerberos	5-1.7.1		Version Details Vulnerabilities
3	Application	MIT	Kerberos	5-1.8	Alpha	Version Details Vulnerabilities

- Number Of Affected Versions By Product

Vendor	Product	Vulnerable Versions
MIT	Kerberos	3

- References For CVE-2010-0283

http://secunia.com/advisories/40220
SECUNIA 40220

http://secunia.com/advisories/39023
SECUNIA 39023

http://support.apple.com/kb/HT4188 CONFIRM

http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035222.html
FEDORA FEDORA-2010-1722

http://secunia.com/advisories/38598
SECUNIA 38598

http://securitytracker.com/id?1023593
SECTRACK 1023593

http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html
APPLE APPLE-SA-2010-06-15-1

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-001.txt CONFIRM

http://www.ubuntu.com/usn/USN-916-1
UBUNTU USN-916-1

http://www.securityfocus.com/bid/38260
BID 38260 MIT Kerberos KDC 'handle_tgt_authdata()' Denial Of Service Vulnerability Release Date:2010-06-15

http://www.securityfocus.com/archive/1/archive/1/509553/100/0/threaded
BUGTRAQ 20100216 MITKRB5-SA-2010-001 [CVE-2010-0283] krb5-1.7 KDC denial of service

http://www.vupen.com/english/advisories/2010/1481
VUPEN ADV-2010-1481

- Metasploit Modules Related To CVE-2010-0283

There are not any metasploit modules related to this CVE entry (Please visit www.metasploit.com for more information)