REDHAT-BUG-566258: High severity kerberos vulnerability

Published Feb 17, 2010

Updated

A denial of service flaw was found in Kerberos's GSS-API spnego security mechanism implementation. A remote attacker could use this flaw to cause gss-server crash via invalid ContextFlags for the reqFlags field in the NegTokenInit in spnegomech.c, which triggers an assertion failure. Similar vulnerability than CVE-2009-0845.

PGP-signed patch from upstream will be available at: http://web.mit.edu/kerberos/advisories/2010-002-patch.txt.asc

Affected Software

1 affected component

MIT Kerberos

Event History

Feb 17, 2010

Data Sourced

via Red Hat·05:56 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-566258?

The severity of REDHAT-BUG-566258 is categorized as a denial of service vulnerability.

How do I fix REDHAT-BUG-566258?

To fix REDHAT-BUG-566258, apply the recommended patches and updates provided by your software vendor.

What software is affected by REDHAT-BUG-566258?

REDHAT-BUG-566258 affects MIT Kerberos and its implementations.

Can REDHAT-BUG-566258 be exploited remotely?

Yes, REDHAT-BUG-566258 can be exploited remotely by an attacker.

What impact does REDHAT-BUG-566258 have on systems?

REDHAT-BUG-566258 can lead to a system crash, causing denial of service.