CVE-2012-1012
First published: Wed Feb 22 2012(Updated: )
It was reported [1] that, within the kadmin protocol, the access controls for get_strings/set_string were insufficient; anyone with global list privileges could get or modify string attributed on any principal. It was also noted that the exposure depends on how generous the kadmind acl was with list permissions and whether or not string attributes were used in deployment (and noting that nothing in the core code uses them yet). This has been fixed upstream [2] and in Fedora [3]. [1] <a href="http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7093">http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7093</a> [2] <a href="http://src.mit.edu/fisheye/changelog/krb5/?cs=25704">http://src.mit.edu/fisheye/changelog/krb5/?cs=25704</a> [3] <a href="http://koji.fedoraproject.org/koji/buildinfo?buildID=300840">http://koji.fedoraproject.org/koji/buildinfo?buildID=300840</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MIT Kerberos 5 Application | =1.10 | |
| MIT Kerberos 5 Application | =1.10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2012-1012?
The severity of CVE-2012-1012 is considered moderate due to insufficient access controls within the kadmin protocol.
How do I fix CVE-2012-1012?
To fix CVE-2012-1012, it is recommended to update to a patched version of MIT Kerberos 5 that addresses the access control issues.
How does CVE-2012-1012 affect affected users?
CVE-2012-1012 allows users with global list privileges to view or modify string attributes of any principal, potentially compromising data integrity.
Which versions of MIT Kerberos 5 are affected by CVE-2012-1012?
CVE-2012-1012 affects MIT Kerberos 5 versions 1.10 and 1.10.1.
Is there an exploit available for CVE-2012-1012?
Currently, there are no public exploits specifically reported for CVE-2012-1012, but the vulnerability itself poses a significant risk if access controls are weak.
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-1012
- agent/trending
- agent/source
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- vendor/mit
- canonical/mit kerberos 5 application
- version/mit kerberos 5 application/1.10
- version/mit kerberos 5 application/1.10.1