|
|
Info |
Last Modified |
| 7 months ago |
|
|
|
|
Description |
MIT Kerberos 5 contains a flaw related to a double free in the KDC ASN.1 error handling code that may allow an attacker to run privileged code of the attackers choosing. MIT note that no published means of exploiting a double free is known, impying that a real world exploit would be difficult at best. Should this feat be achieved, a complete Kerberos realm could be compromised.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Authentication Management
Impact:
Loss of Confidentiality
Exploit:
Exploit Rumored / Private
Disclosure:
OSVDB Verified
|
|
Solution |
Upgrade to version 1.3.5 or higher, as it has been reported to fix this vulnerability. An upgrade is required as the fix is complex and affects library code as well as executables.
|
|
Products |
|
Kerberos 5
 |
1.3.4 |
|
|
|
|
|
|
Credit |
- Will Fiveash - SUN Microsystems
- Nico Williams -
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
