CVE-2010-1324 Security feature bypass in n/a
Remote attackers can forge GSS tokens to gain privileges or bypass security checks due to improper checksum validation in Kerberos.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-1324?
CVE-2010-1324 is a low-severity vulnerability in Mit Kerberos 5, published on 2 Dec 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.
Weakness: CWE-310
Which versions are affected by CVE-2010-1324?
It affects 1 product.
Products include Mit Kerberos 5.
How do I fix CVE-2010-1324?
Apply the vendor's patch.
Is CVE-2010-1324 being exploited?
There is no known exploitation of CVE-2010-1324 in the wild and no public exploit code.
Other vulnerabilities in Mit Kerberos 5
Sources
Also known as DEBIAN-CVE-2010-1324, GHSA-gg3r-9x7c-vmfm.