CVE-2011-0284 — Double Free in Kerberos 5

CWE-3999 documents8 sources

Severity

7.6HIGHNVD

EPSS

22.6%

top 4.13%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

MIT Krb5 MIT Kerberos 5

Timeline

PublishedMar 20

Latest updateMay 13

Description

Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT feature is enabled, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an e_data field containing typed data.

CVSS vector

AV:N/AC:H/C:C/I:C/A:CExploitability: 4.9 | Impact: 10.0

Affected Packages2 packages

▶Debianmit/krb5< 1.8.3+dfsg-6+3

▶NVDmit/kerberos_57 versions+6

Patches

Patch: web.mit.edu ↗Patch: www.kb.cert.org ↗Patch: web.mit.edu ↗

🔴Vulnerability Details

GHSA

GHSA-w63f-q474-3fj3: Double free vulnerability in the prepare_error_as function in do_as_req↗2022-05-13

▶

CVEList

CVE-2011-0284: Double free vulnerability in the prepare_error_as function in do_as_req↗2011-03-20

▶

OSV

CVE-2011-0284: Double free vulnerability in the prepare_error_as function in do_as_req↗2011-03-20

▶

📋Vendor Advisories

Ubuntu

Kerberos vulnerability↗2011-03-15

▶

Red Hat

(krb5kdc): Double-free flaw by handling error messages upon receiving certain AS_REQ's (MITKRB5-SA-2011-003)↗2011-03-15

▶

Debian

CVE-2011-0284: krb5 - Double free vulnerability in the prepare_error_as function in do_as_req.c in the...↗2011

▶

💬Community

Bugzilla

CVE-2011-0284 krb5 (krb5kdc): Double-free flaw by handling error messages upon receiving certain AS_REQ's (MITKRB5-SA-2011-003) [fedora-all]↗2011-03-16

▶

Bugzilla

CVE-2011-0284 krb5 (krb5kdc): Double-free flaw by handling error messages upon receiving certain AS_REQ's (MITKRB5-SA-2011-003)↗2011-02-01

▶