MIT Kerberos 5 (krb5) contains a flaw related to the acceptability of checksums. This may allow a remote attacker to modify user-visible prompt text, modify a reponse to a KDC, or forge a KRB-SAFE message via unkeyed checksums or the use of RC4 keys.

Currently, there are no known workarounds or upgrades to correct this issue. However, MIT has released a patch to address this vulnerability. Check the vendor advisory or solution in the references section.

• CVE ID: 2010-1323 (see also: NVD)
• Secunia Advisory ID: 42396 42399 42420 42436 42558 42746 43015 43814 44391 44534 46397 47442 47658
• Related OSVDB ID: 69607 69608 69609 71972
• Vendor Specific Advisory URL: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02657328
  http://support.apple.com/kb/HT1222
  http://support.apple.com/kb/HT4581
  http://www.debian.org/security/2010/dsa-2129
  http://www.ubuntu.com/usn/usn-1030-1
  https://rhn.redhat.com/errata/RHSA-2010-0925.html
  https://rhn.redhat.com/errata/RHSA-2010-0926.html
  https://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02824440
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
  http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
  http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
  http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt
  http://www.gentoo.org/security/en/glsa/glsa-201201-13.xml
  http://www.vmware.com/security/advisories/VMSA-2011-0012.html
• Mail List Post: http://seclists.org/bugtraq/2010/Nov/229
  http://seclists.org/bugtraq/2011/May/67
• News Article: http://www.scmagazineus.com/apple-issues-slew-of-patches/article/198899/
• Other Advisory URL: http://www.vmware.com/security/advisories/VMSA-2011-0007.html

• Not Available