FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2010-0628

This CVE name corresponds to:

Entered Topic
2010-04-19 krb5 -- multiple denial of service vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2010-0628
Phase Assigned(20100212)

Description

The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.

References

Source Reference
BUGTRAQ 20100323 MITKRB5-SA-2010-002 denial of service in SPNEGO [CVE-2010-0628 VU#839413]
CONFIRM http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-002.txt
CONFIRM https://bugzilla.redhat.com/show_bug.cgi?id=566258
UBUNTU USN-916-1
CERT-VN VU#839413
BID 38904
SECUNIA 39023