Red Hat Security AdvisoryRHSA-2010:0925
krb5 security and bug fix update
Released 2010-11-30 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Desktop (v. 6) krb5-1.8.2-3.el6_0.3, krb5-libs-1.8.2-3.el6_0.3, krb5-pkinit-openssl-1.8.2-3.el6_0.3 +1
- Red Hat Enterprise Linux Desktop Optional (v. 6) krb5-1.8.2-3.el6_0.3, krb5-devel-1.8.2-3.el6_0.3, krb5-server-1.8.2-3.el6_0.3 +1
- Red Hat Enterprise Linux HPC Node (v. 6) krb5-1.8.2-3.el6_0.3, krb5-libs-1.8.2-3.el6_0.3
- Red Hat Enterprise Linux HPC Node Optional (v. 6) krb5-1.8.2-3.el6_0.3, krb5-devel-1.8.2-3.el6_0.3, krb5-pkinit-openssl-1.8.2-3.el6_0.3 +3
- Red Hat Enterprise Linux Server (v. 6) krb5-1.8.2-3.el6_0.3, krb5-devel-1.8.2-3.el6_0.3, krb5-devel-1.8.2-3.el6_0.3.ppc +7
- Red Hat Enterprise Linux Workstation (v. 6) krb5-1.8.2-3.el6_0.3, krb5-devel-1.8.2-3.el6_0.3, krb5-libs-1.8.2-3.el6_0.3 +4
Fixes 3 records
Priority LOW 32
MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain priv…
CVSS 3.0MEDIUM 6.3· Network · Low privileges · No interaction · EPSS 0.01916 · Published 2010-12-02 · Fixed CWE-310
Priority LOW 23
MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modi…
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.02847 · Published 2010-12-02 · Fixed CWE-310
Priority LOW 22
MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impac…
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.02253 · Published 2010-12-02 · Fixed CWE-310
THREATIST.IORead the docs