CVE-2010-0628

The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.
Severity
UNKNOWN
AV:N/AC:L/Au:N/C:N/I:N/A:P
Atk. Vector
NETWORK
Atk. Complexity
LOW
Base Score
CVSS 3.x
EPSS Score
Percentile: 95%
VendorProductVersion
mitkerberos_5
1.7
mitkerberos_5
1.7.1
mitkerberos_5
1.8
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
krb5
bullseye (security)
1.18.3-6+deb11u5
fixed
bullseye
1.18.3-6+deb11u5
fixed
lenny
not-affected
bookworm
1.20.1-2+deb12u2
fixed
bookworm (security)
1.20.1-2+deb12u2
fixed
sid
1.21.3-3
fixed
trixie
1.21.3-3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
krb5
karmic
Fixed 1.7dfsg~beta3-1ubuntu0.5
released
jaunty
not-affected
intrepid
not-affected
hardy
not-affected
dapper
not-affected
References
http://secunia.com/advisories/39023
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt
http://www.kb.cert.org/vuls/id/839413
http://www.securityfocus.com/archive/1/510281/100/0/threaded
http://www.securityfocus.com/bid/38904
http://www.ubuntu.com/usn/USN-916-1
https://bugzilla.redhat.com/show_bug.cgi?id=566258
http://secunia.com/advisories/39023
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt
http://www.kb.cert.org/vuls/id/839413
http://www.securityfocus.com/archive/1/510281/100/0/threaded
http://www.securityfocus.com/bid/38904
http://www.ubuntu.com/usn/USN-916-1
https://bugzilla.redhat.com/show_bug.cgi?id=566258