MIT Kerberos krb5 Key Distribution Center PKINIT Double-free Vulnerability
Last Update Date:
17 Mar 2011 09:39
Release Date:
17 Mar 2011
6508
Views
RISK: High Risk
TYPE: Security software and application - Security Software & Appliance
A vulnerability has been identified in MIT Kerberos, which could be exploited by remote attackers to cause a denial of service or compromise a vulnerable system. This issue is caused by a double-free error in the "perpare_error_as()" [do_as_req.c] function within the Key Distribution Center (KDC) daemon when the Public Key Cryptography for Initial Authentication (PKINIT) capability is enabled, which could be exploited by remote unauthenticated attackers to crash an affected daemon or execute arbitrary code.
Impact
- Denial of Service
- Remote Code Execution
System / Technologies affected
- MIT Kerberos version krb5-1.7 and later
Solutions
Before installation of the software, please visit the software manufacturer web-site for more details.
Vulnerability Identifier
Source
Related Link
Share with