CVE-2012-1016

説明

CVE.org より

The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request.

詳細

This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5 as they did not include support for PKINIT.

CVSS (Common Vulnerability Scoring System) のスコアの詳細

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v2 スコアの内訳

Red HatNVDcve.org
ベーススコア4.35N/A
攻撃ベクトルNetworkNetworkN/A
アクセスの複雑さMediumLowN/A
認証NoneNoneN/A
機密性への影響NoneNoneN/A
完全性への影響NoneNoneN/A
可用性への影響PartialPartialN/A

ベクトル

Red Hat: AV:N/AC:M/Au:N/C:N/I:N/A:P

NVD: AV:N/AC:L/Au:N/C:N/I:N/A:P

脆弱性の原因 (CWE) の理解

CWE-476

Availability

Technical Impact: DoS: Crash, Exit, or Restart

NULL pointer dereferences usually result in the failure of the process unless exception handling (on some platforms) is available and implemented. Even when exception handling is being used, it can still be very difficult to return the software to a safe state of operation.

Integrity,Confidentiality

Technical Impact: Execute Unauthorized Code or Commands; Read Memory; Modify Memory

In rare circumstances, when NULL is equivalent to the 0x0 memory address and privileged code can access it, then writing or reading memory is possible, which may lead to code execution.

よくある質問

Not sure what something means? Check out our Security Glossary.

エラータ通知の受信を希望しますか? こちらで登録してください。