CVE-2010-1320: Double Free

Published Apr 22, 2010

Updated

Double free vulnerability in dotgsreq.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with (1) renewal or (2) validation.

Affected Software

4 affected components

MIT Kerberos 5=1.7

MIT Kerberos 5=1.7.1

MIT Kerberos 5=1.8

MIT Kerberos 5=1.8.1

Event History

Apr 22, 2010

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Data Sourced

via NVD·02:30 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What are the potential impacts of CVE-2010-1320?

CVE-2010-1320 can lead to a denial of service through daemon crashes or potentially allow remote authenticated users to execute arbitrary code.

Which versions of MIT Kerberos 5 are affected by CVE-2010-1320?

CVE-2010-1320 affects MIT Kerberos 5 versions 1.7.x and 1.8.x prior to 1.8.2.

Is CVE-2010-1320 a local or remote vulnerability?

CVE-2010-1320 is a remote vulnerability that can be exploited by authenticated users.

How can organizations mitigate the risks associated with CVE-2010-1320?

Organizations can mitigate CVE-2010-1320 by upgrading to MIT Kerberos 5 version 1.8.2 or later.

What is the nature of the vulnerability described in CVE-2010-1320?

CVE-2010-1320 is a double free vulnerability found in the Key Distribution Center (KDC) of MIT Kerberos 5.