| Description: | Summary:
The remote host is missing an update for the 'krb5' package(s) announced via the USN-1030-1 advisory.
Vulnerability Insight:
It was discovered that Kerberos did not properly determine the
acceptability of certain checksums. A remote attacker could use certain
checksums to alter the prompt message, modify a response to a Key
Distribution Center (KDC) or forge a KRB-SAFE message. (CVE-2010-1323)
It was discovered that Kerberos did not properly determine the
acceptability of certain checksums. A remote attacker could use certain
checksums to forge GSS tokens or gain privileges. This issue only affected
Ubuntu 9.10, 10.04 LTS and 10.10. (CVE-2010-1324)
It was discovered that Kerberos did not reject RC4 key-derivation
checksums. An authenticated remote user could use this issue to forge
AD-SIGNEDPATH or AD-KDC-ISSUED signatures and possibly gain privileges.
This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4020)
It was discovered that Kerberos did not properly restrict the use of TGT
credentials for armoring TGS requests. A remote authenticated user could
use this flaw to impersonate a client. This issue only affected Ubuntu
9.10. (CVE-2010-4021)
Affected Software/OS:
'krb5' package(s) on Ubuntu 6.06, Ubuntu 8.04, Ubuntu 9.10, Ubuntu 10.04, Ubuntu 10.10.
Solution:
Please install the updated package(s).
CVSS Score:
4.3
CVSS Vector:
AV:N/AC:M/Au:N/C:N/I:P/A:N
|
