CVE-2010-4022: Input Validation

Published Feb 10, 2011

Updated

The dostandalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1.7, 1.8, and 1.9, when running in standalone mode, does not properly handle when a worker child process "exits abnormally," which allows remote attackers to cause a denial of service (listening process termination, no new connections, and lack of updates in slave KVC) via unspecified vectors.

Affected Software

3 affected components

MIT Kerberos 5=1.7

MIT Kerberos 5=1.8

MIT Kerberos 5=1.9

Remediation

Patch Available

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt

Event History

Feb 10, 2011

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-4022?

CVE-2010-4022 is classified as a denial of service vulnerability that can be exploited by remote attackers.

How do I fix CVE-2010-4022?

To mitigate CVE-2010-4022, users should upgrade to a patched version of MIT Kerberos, specifically versions 1.10 and later.

What versions of Kerberos are affected by CVE-2010-4022?

CVE-2010-4022 affects MIT Kerberos versions 1.7, 1.8, and 1.9.

Can CVE-2010-4022 be exploited remotely?

Yes, CVE-2010-4022 allows remote attackers to cause a denial of service.

What is the potential impact of CVE-2010-4022?

The potential impact of CVE-2010-4022 is that it can lead to a denial of service, disrupting the availability of the affected service.