CVE-2012-1012

2012-06-0719:55:07

Debian Security Bug Tracker

security-tracker.debian.org

mit kerberos 5

server_stubs.c

vulnerability

remote authenticated admins

string attributes

access restriction

global list privilege

cve-2012-1012

unix

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

EPSS

0.002

Percentile

61.1%

JSON

server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege.

OSVersionArchitecturePackageVersionFilename
Debian12allkrb5< 1.10.1+dfsg-1krb5_1.10.1+dfsg-1_all.deb
Debian11allkrb5< 1.10.1+dfsg-1krb5_1.10.1+dfsg-1_all.deb
Debian999allkrb5< 1.10.1+dfsg-1krb5_1.10.1+dfsg-1_all.deb
Debian13allkrb5< 1.10.1+dfsg-1krb5_1.10.1+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	krb5	< 1.10.1+dfsg-1	krb5_1.10.1+dfsg-1_all.deb
Debian	11	all	krb5	< 1.10.1+dfsg-1	krb5_1.10.1+dfsg-1_all.deb
Debian	999	all	krb5	< 1.10.1+dfsg-1	krb5_1.10.1+dfsg-1_all.deb
Debian	13	all	krb5	< 1.10.1+dfsg-1	krb5_1.10.1+dfsg-1_all.deb