SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Kerberos Vendors:   MIT
Kerberos kadmin randkey Function Lets Remote Authenticated Administrators Obtain Old Keys and Potentially Forge Tickets
SecurityTracker Alert ID:  1031003
SecurityTracker URL:  http://securitytracker.com/id/1031003
CVE Reference:   CVE-2014-5351   (Links to External Site)
Date:  Oct 14 2014
Impact:   Modification of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to krb5-1.13
Description:   A vulnerability was reported in Kerberos. A remote authenticated user can forge tickets.

A remote authenticated administrative user can invoke the kadmin randkey RPC operation with the '-keepold' flag to obtain old keys and potentially forge authentication tickets.

Impact:   A remote authenticated user can forge tickets.
Solution:   The vendor has issued a source code fix, available at:

https://github.com/krb5/krb5/commit/af0ed4df4dfae762ab5fb605f5a0c8f59cb4f6ca

Vendor URL:  web.mit.edu/kerberos/ (Links to External Site)
Cause:   Access control error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jan 20 2015 (IBM Issues Fix for IBM AIX) Kerberos kadmin randkey Function Lets Remote Authenticated Administrators Obtain Old Keys and Potentially Forge Tickets
IBM has issued a fix for IBM AIX 5.3, 6.1, and 7.1.
Feb 11 2015 (Ubuntu Issues Fix) Kerberos kadmin randkey Function Lets Remote Authenticated Administrators Obtain Old Keys and Potentially Forge Tickets
Ubuntu has issued a fix for Ubuntu 10.04 LTS, 12.04 LTS, 14.04 LTS, and 14.10.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC