6.8 - CVE-2011-1530

Executive Summary

Informations
Name	CVE-2011-1530	First vendor Publication	2011-12-08
Vendor	Cve	Last vendor Modification	2018-10-09

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:N/I:N/A:C)
Cvss Base Score	6.8	Attack Range	Network
Cvss Impact Score	6.9	Attack Complexity	Low
Cvss Expoit Score	8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an error other than the KRB5_KDB_NOENTRY error.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1530

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-399	Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:15363

Oval ID:	oval:org.mitre.oval:def:15363
Title:	USN-1290-1 -- Kerberos vulnerability
Description:	krb5: MIT Kerberos Network Authentication Protocol The Kerberos Key Distribution Center could be made to crash.
Family:	unix	Class:	patch
Reference(s):	USN-1290-1 CVE-2011-1530	Version:	5
Platform(s):	Ubuntu 11.10	Product(s):	Kerberos
Definition Synopsis:
Ubuntu 11.10 is installed AND Installed architecture is all AND krb5-kdc DPKG is earlier than 1.9.1+dfsg-1ubuntu2.2

Definition Id: oval:org.mitre.oval:def:22167

Oval ID:	oval:org.mitre.oval:def:22167
Title:	RHSA-2011:1790: krb5 security update (Moderate)
Description:	The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an error other than the KRB5_KDB_NOENTRY error.
Family:	unix	Class:	patch
Reference(s):	RHSA-2011:1790-01 CESA-2011:1790 CVE-2011-1530	Version:	4
Platform(s):	Red Hat Enterprise Linux 6 CentOS Linux 6	Product(s):	krb5
Definition Synopsis:
Redhat 6 or Centos 6 release The operating system installed on the system is Red Hat Enterprise Linux 6 AND The operating system installed on the system is CentOS Linux 6.x Packages section krb5-devel is earlier than 0:1.9-22.el6_2.1 AND krb5-server-ldap is earlier than 0:1.9-22.el6_2.1 AND krb5-workstation is earlier than 0:1.9-22.el6_2.1 AND krb5-libs is earlier than 0:1.9-22.el6_2.1 AND krb5-pkinit-openssl is earlier than 0:1.9-22.el6_2.1 AND krb5-server is earlier than 0:1.9-22.el6_2.1 AND krb5 is earlier than 0:1.9-22.el6_2.1

Definition Id: oval:org.mitre.oval:def:23672

Oval ID:	oval:org.mitre.oval:def:23672
Title:	ELSA-2011:1790: krb5 security update (Moderate)
Description:	The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an error other than the KRB5_KDB_NOENTRY error.
Family:	unix	Class:	patch
Reference(s):	ELSA-2011:1790-01 CVE-2011-1530	Version:	6
Platform(s):	Oracle Linux 6	Product(s):	krb5
Definition Synopsis:
Oracle Linux 6.x rpm test krb5-devel is earlier than 0:1.9-22.el6_2.1 AND krb5-server-ldap is earlier than 0:1.9-22.el6_2.1 AND krb5-workstation is earlier than 0:1.9-22.el6_2.1 AND krb5-libs is earlier than 0:1.9-22.el6_2.1 AND krb5-pkinit-openssl is earlier than 0:1.9-22.el6_2.1 AND krb5-server is earlier than 0:1.9-22.el6_2.1 AND krb5 is earlier than 0:1.9-22.el6_2.1

Definition Id: oval:org.mitre.oval:def:27169

Oval ID:	oval:org.mitre.oval:def:27169
Title:	DEPRECATED: ELSA-2011-1790 -- krb5 security update (moderate)
Description:	[1.9-22.1] - add candidate patch to fix a NULL pointer dereference while processing TGS requests (MITKRB5-SA-2011-007, #754046)
Family:	unix	Class:	patch
Reference(s):	ELSA-2011-1790 CVE-2011-1530	Version:	4
Platform(s):	Oracle Linux 6	Product(s):	krb5
Definition Synopsis:
Oracle Linux 6.x Packages match section krb5 is earlier than 0:1.9-22.el6_2.1 AND krb5-devel is earlier than 0:1.9-22.el6_2.1 AND krb5-libs is earlier than 0:1.9-22.el6_2.1 AND krb5-pkinit-openssl is earlier than 0:1.9-22.el6_2.1 AND krb5-server is earlier than 0:1.9-22.el6_2.1 AND krb5-server-ldap is earlier than 0:1.9-22.el6_2.1 AND krb5-workstation is earlier than 0:1.9-22.el6_2.1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mit Mit Kerberos cpe:2.3:a:mit:mit_kerberos:5.1.9.2:::::::* cpe:2.3:a:mit:mit_kerberos:5.1.9.1:::::::* cpe:2.3:a:mit:mit_kerberos:5.1.9:::::::*	3

OpenVAS Exploits

Date	Description
2012-08-14	Name : Fedora Update for krb5 FEDORA-2012-11370 File : nvt/gb_fedora_2012_11370_krb5_fc16.nasl
2012-07-30	Name : CentOS Update for krb5-devel CESA-2011:1790 centos6 File : nvt/gb_CESA-2011_1790_krb5-devel_centos6.nasl
2012-07-09	Name : RedHat Update for krb5 RHSA-2011:1790-01 File : nvt/gb_RHSA-2011_1790-01_krb5.nasl
2012-06-15	Name : Fedora Update for krb5 FEDORA-2012-8803 File : nvt/gb_fedora_2012_8803_krb5_fc16.nasl
2012-06-15	Name : Fedora Update for krb5 FEDORA-2012-8805 File : nvt/gb_fedora_2012_8805_krb5_fc15.nasl
2012-04-02	Name : Fedora Update for krb5 FEDORA-2011-16296 File : nvt/gb_fedora_2011_16296_krb5_fc16.nasl
2012-03-16	Name : Ubuntu Update for krb5 USN-1290-1 File : nvt/gb_ubuntu_USN_1290_1.nasl
2012-02-12	Name : Gentoo Security Advisory GLSA 201201-13 (mit-krb5) File : nvt/glsa_201201_13.nasl
2012-02-01	Name : Fedora Update for krb5 FEDORA-2011-16284 File : nvt/gb_fedora_2011_16284_krb5_fc15.nasl
0000-00-00	Name : FreeBSD Ports: krb5 File : nvt/freebsd_krb514.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
77572	MIT Kerberos 5 (krb5) src/kdc/do_tgs_req.c process_tgs_req() Function TGS Req...

Nessus® Vulnerability Scanner

Date	Description
2014-11-17	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1850.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : openSUSE-2011-58.nasl - Type : ACT_GATHER_INFO
2013-09-04	Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2011-28.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1790.nasl - Type : ACT_GATHER_INFO
2012-09-06	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-184.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20111206_krb5_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-02-01	Name : The remote Fedora host is missing a security update. File : fedora_2011-16284.nasl - Type : ACT_GATHER_INFO
2012-01-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201201-13.nasl - Type : ACT_GATHER_INFO
2011-12-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2011-1790.nasl - Type : ACT_GATHER_INFO
2011-12-14	Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_6c7d9a35260811e189b4001ec9578670.nasl - Type : ACT_GATHER_INFO
2011-12-13	Name : The remote Fedora host is missing a security update. File : fedora_2011-16296.nasl - Type : ACT_GATHER_INFO
2011-12-08	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1290-1.nasl - Type : ACT_GATHER_INFO
2011-12-07	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1790.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/50929
BUGTRAQ	http://www.securityfocus.com/archive/1/520756/100/0/threaded
CONFIRM	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-007.txt
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2011:184
REDHAT	http://www.redhat.com/support/errata/RHSA-2011-1790.html
SECTRACK	http://securitytracker.com/id?1026374
SECUNIA	http://secunia.com/advisories/47124
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/71655

Alert History

If you want to see full details history, please login or register.

Date	Informations
2021-05-04 12:14:20	Multiple Updates
2021-04-22 01:15:35	Multiple Updates
2020-05-23 00:28:19	Multiple Updates
2018-10-10 00:19:43	Multiple Updates
2017-08-17 09:23:29	Multiple Updates
2016-04-26 20:41:54	Multiple Updates
2014-11-18 13:25:46	Multiple Updates
2014-06-14 13:30:38	Multiple Updates
2014-02-17 11:01:48	Multiple Updates
2013-05-10 22:58:33	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	4
CPE ID(s)	3
Sources(s)	8
osvdb(s)	1
Openvas Exploit(s)	10
Nessus® Exploit(s)	13

	Related
10	GLSA-201201-13
6.8	USN-1290-1
6.8	RHSA-2011:1790
6.8	MDVSA-2011:184
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)

6.8 - CVE-2011-1530

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU