CVE-2010-1322: Input Validation
The mergeauthdata function in kdcauthdata.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x before 1.8.4 does not properly manage an index into an authorization-data list, which allows remote attackers to cause a denial of service (daemon crash), or possibly obtain sensitive information, spoof authorization, or execute arbitrary code, via a TGS request that triggers an uninitialized pointer dereference, as demonstrated by a request from a Windows Active Directory client.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-1322?
CVE-2010-1322 is classified as a medium-severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2010-1322?
To fix CVE-2010-1322, you should upgrade to MIT Kerberos 5 version 1.8.4 or later.
What systems are affected by CVE-2010-1322?
CVE-2010-1322 affects MIT Kerberos 5 versions 1.8 through 1.8.3.
What type of vulnerability is CVE-2010-1322?
CVE-2010-1322 is a denial of service vulnerability that allows attackers to crash the KDC daemon.
Can CVE-2010-1322 lead to data exposure?
While CVE-2010-1322 primarily causes denial of service, it could potentially be exploited to access sensitive information.