CVE-2010-0628: Medium severity MIT Kerberos 5 vulnerability
A denial of service flaw was found in Kerberos's GSS-API spnego security mechanism implementation. A remote attacker could use this flaw to cause gss-server crash via invalid ContextFlags for the reqFlags field in the NegTokenInit in spnegomech.c, which triggers an assertion failure. Similar vulnerability than CVE-2009-0845.
PGP-signed patch from upstream will be available at: http://web.mit.edu/kerberos/advisories/2010-002-patch.txt.asc
Other sources
The spnegogssacceptseccontext function in lib/gssapi/spnego/spnegomech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0628?
CVE-2010-0628 is classified as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2010-0628?
To fix CVE-2010-0628, you should update to a patched version of MIT Kerberos 5 that addresses this flaw.
Which versions of MIT Kerberos 5 are affected by CVE-2010-0628?
The affected versions of MIT Kerberos 5 include 1.7, 1.7.1, and 1.8.
What type of attack can exploit CVE-2010-0628?
CVE-2010-0628 can be exploited by remote attackers to create a denial of service condition by crashing the gss-server.
What mechanism is impacted by CVE-2010-0628?
CVE-2010-0628 affects the GSS-API spnego security mechanism implementation in Kerberos.