What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Discussion

Kerberos vuln - update available

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Post #1 last edited
FYI…

Kerberos Security Advisories
- http://web.mit.edu/kerberos/www/advisories…SA-2009-001.txt
Last update: 2009-04-07
Topic: multiple vulnerabilities in SPNEGO, ASN.1 decoder
…The upcoming krb5-1.7 and krb5-1.6.4 releases will contain fixes for these vulnerabilities… (or) Apply the patch, available at:
http://web.mit.edu/kerberos/advisories/2009-001-patch.txt …
- http://web.nvd.nist.gov/view/vuln/detail?v…d=CVE-2009-0844
- http://web.nvd.nist.gov/view/vuln/detail?v…d=CVE-2009-0845
- http://web.nvd.nist.gov/view/vuln/detail?v…d=CVE-2009-0847

- http://web.mit.edu/kerberos/www/advisories…SA-2009-002.txt
Last update: 2009-04-07
Topic: ASN.1 decoder
…This is an implementation vulnerability in MIT krb5, and is not a vulnerability in the Kerberos protocol… The upcoming krb5-1.7 and krb5-1.6.4 releases will contain fixes for this vulnerability… (or) patch is also available at:
http://web.mit.edu/kerberos/advisories/2009-002-patch.txt
- http://web.nvd.nist.gov/view/vuln/detail?v…d=CVE-2009-0846 CVSS Severity: 10.0 (HIGH)

- http://atlas.arbor.net/briefs/index#-2016235497
April 13, 2009 - "MIT Kerberos 5 (krb5) versions prior to 1.6.4 , which is the foundation for many commercial Kerberos implementations, is vulnerable to three separate issues…"

- http://secunia.com/advisories/34347/2/
Last Update: 2009-04-08
Critical: Highly critical
Impact: Exposure of sensitive information, DoS, System access
Where: From remote
Solution Status: Vendor Patch
Software: Kerberos 5.x
Solution: Apply patches.
http://web.mit.edu/kerberos/advisories/2009-001-patch.txt
http://web.mit.edu/kerberos/advisories/2009-002-patch.txt
Reportedly, the vulnerabilities will also be fixed in the upcoming 1.7 and 1.6.4 release versions…
- http://secunia.com/advisories/34734/2/
Release Date: 2009-04-16

:ph34r:
Post #2 last edited
FYI…

Kerberos vuln - update available
- http://secunia.com/advisories/37977/2/
Release Date: 2009-12-29
Critical: Moderately critical
Impact: DoS
Where: From remote
Solution Status: Vendor Patch
Software: Kerberos 5.x
Solution: Apply patch:
http://web.mit.edu/kerberos/advisories/2009-003-patch.txt
The vulnerability will also be fixed in the upcoming krb5-1.7.1…

- http://web.nvd.nist.gov/view/vuln/detail?v…d=CVE-2009-3295
Last revised: 12/30/2009

- http://securitytracker.com/alerts/2009/Dec/1023392.html
Date: Dec 29 2009

:ph34r: