CVE-2010-1321

Publication date 18 May 2010

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The kg_accept_krb5 function in krb5/accept_sec_context.c in the GSS-API library in MIT Kerberos 5 (aka krb5) through 1.7.1 and 1.8 before 1.8.2, as used in kadmind and other applications, does not properly check for invalid GSS-API tokens, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an AP-REQ message in which the authenticator’s checksum field is missing.

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
krb5 10.04 LTS lucid
Fixed 1.8.1+dfsg-2ubuntu0.2
9.10 karmic
Fixed 1.7dfsg~beta3-1ubuntu0.6
9.04 jaunty
Fixed 1.6.dfsg.4~beta1-5ubuntu2.4
8.04 LTS hardy
Fixed 1.6.dfsg.3~beta1-2ubuntu1.5
6.06 LTS dapper
Fixed 1.4.3-5ubuntu0.11
sun-jav6 10.10 maverick
Fixed 6.22-0ubuntu1~10.10
10.04 LTS lucid
Fixed 6.22-0ubuntu1~10.04
9.10 karmic
Fixed 6.22-0ubuntu1~9.10.1
9.04 jaunty
Fixed 6.22-0ubuntu1~9.04.1
8.04 LTS hardy
Fixed 6.22-0ubuntu1~8.04.1
6.06 LTS dapper Not in release

References

Related Ubuntu Security Notices (USN)

    • USN-940-2
    • Kerberos vulnerability
    • 21 July 2010
    • USN-940-1
    • Kerberos vulnerabilities
    • 19 May 2010

Other references