what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2010-246

Posted Dec 1, 2010

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2010-246 - Multiple vulnerabilities were discovered and corrected in krb5. An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted pre-existing application session uses a DES session key. Various other issues have also been addressed. The updated packages have been patched to correct these issues.

tags | advisory, remote, vulnerability, protocol

systems | linux, mandriva

advisories | CVE-2010-1323, CVE-2010-1324, CVE-2010-4020, CVE-2010-4021

SHA-256 | 100c7557ed59ca637d4f6b0069c888d50046989349e8acc0e9bed9cabffe8976

Download | Favorite | View

Related Files

No related files