Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:
Category:Red Hat Local Security Checks
Title:RedHat Update for krb5 RHSA-2011:0356-01
Summary:The remote host is missing an update for the 'krb5'; package(s) announced via the referenced advisory.
The remote host is missing an update for the 'krb5'
package(s) announced via the referenced advisory.

Vulnerability Insight:
Kerberos is a network authentication system which allows clients and
servers to authenticate to each other using symmetric encryption and a
trusted third-party, the Key Distribution Center (KDC). The Public Key
Cryptography for Initial Authentication in Kerberos (PKINIT) capability
provides support for using public-key authentication with Kerberos.

A double-free flaw was found in the way the MIT Kerberos KDC handled
initial authentication requests (AS-REQ), when the KDC was configured to
provide the PKINIT capability. A remote attacker could use this flaw to
cause the KDC daemon to abort by using a specially-crafted AS-REQ request.

All krb5 users should upgrade to these updated packages, which contain
a backported patch to correct this issue. After installing the updated
packages, the krb5kdc daemon will be restarted automatically.

Affected Software/OS:
krb5 on Red Hat Enterprise Linux Desktop (v. 6),
Red Hat Enterprise Linux Server (v. 6),
Red Hat Enterprise Linux Workstation (v. 6)

Please Install the Updated Packages.

CVSS Score:

CVSS Vector:

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2011-0284
BugTraq ID: 46881
Bugtraq: 20110315 MITKRB5-SA-2011-003 [CVE-2011-0284] KDC double-free when PKINIT enabled (Google Search)
CERT/CC vulnerability note: VU#943220
SuSE Security Announcement: SUSE-SR:2011:005 (Google Search)
XForce ISS Database: kerberos-perpareerroras-code-execution(66101)
CopyrightCopyright (c) 2012 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.

© 1998-2021 E-Soft Inc. All rights reserved.