CVE-2010-4022 — Improper Input Validation in Kerberos 5

CWE-20 — Improper Input Validation14 documents9 sources
Severity
5.0MEDIUMNVD
EPSS
9.0%
top 7.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MIT Krb5MIT Kerberos 5
Timeline
PublishedFeb 10
Latest updateMay 13

Description

The do_standalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1.7, 1.8, and 1.9, when running in standalone mode, does not properly handle when a worker child process "exits abnormally," which allows remote attackers to cause a denial of service (listening process termination, no new connections, and lack of updates in slave KVC) via unspecified vectors.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debianmit/krb5< 1.8.3+dfsg-5+3
▶NVDmit/kerberos_51.7, 1.8, 1.9+2

Patches

Patch: web.mit.edu ↗Patch: web.mit.edu ↗

🔴Vulnerability Details

3
GHSA
GHSA-x83g-f3w6-mr3j: The do_standalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1↗2022-05-13
▶
CVEList
CVE-2010-4022: The do_standalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1↗2011-02-10
▶
OSV
CVE-2010-4022: The do_standalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1↗2011-02-10
▶

📋Vendor Advisories

5
Ubuntu
Kerberos vulnerabilities↗2011-02-15
▶
Red Hat
krb5: kpropd unexpected termination on invalid input (MITKRB5-SA-2011-001)↗2011-02-08
▶
Red Hat
BIND upstream fix for CVE-2009-4022 is incomplete↗2010-01-19
▶
Red Hat
bind: out-of-bailiwick data vulnerability due to regression while fixing CVE-2009-4022↗2010-01-19
▶
Debian
CVE-2010-4022: krb5 - The do_standalone function in the MIT krb5 KDC database propagation daemon (kpro...↗2010
▶

💬Community

4
Bugzilla
CVE-2010-4022 CVE-2011-0281 CVE-2011-0282 krb5 various flaws [fedora-all]↗2011-02-08
▶
Bugzilla
CVE-2010-4022 krb5: kpropd unexpected termination on invalid input (MITKRB5-SA-2011-001)↗2010-12-17
▶
Bugzilla
CVE-2010-0382 bind: out-of-bailiwick data vulnerability due to regression while fixing CVE-2009-4022↗2010-01-22
▶
Bugzilla
CVE-2010-0290 BIND upstream fix for CVE-2009-4022 is incomplete↗2010-01-20
▶
CVE-2010-4022 — Improper Input Validation in Kerberos 5 | cvebase