CVE-2010-1324: Medium severity kerberos vulnerability

Published Dec 2, 2010

Updated

MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.

Affected Software

6 affected components

MIT Kerberos 5=1.7

MIT Kerberos 5=1.7.1

MIT Kerberos 5=1.8

MIT Kerberos 5=1.8.1

MIT Kerberos 5=1.8.2

MIT Kerberos 5=1.8.3

Remediation

Patch Available

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Event History

Dec 2, 2010

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-1324?

The severity of CVE-2010-1324 is considered high due to the potential for privilege escalation.

How do I fix CVE-2010-1324?

To fix CVE-2010-1324, you should upgrade MIT Kerberos 5 to version 1.8.4 or later.

What types of attacks can be executed due to CVE-2010-1324?

CVE-2010-1324 can allow remote attackers to forge GSS tokens and gain privileges.

Which versions of MIT Kerberos are affected by CVE-2010-1324?

MIT Kerberos 5 versions 1.7.x and 1.8.x through 1.8.3 are affected by CVE-2010-1324.

Is CVE-2010-1324 related to checksum vulnerabilities?

Yes, CVE-2010-1324 involves improper determination of checksum acceptability, which can be exploited.