CVE-2011-0282 Affecting krb5-devel package, versions <0:1.8.2-3.el6_0.4


Severity

Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
14.63% (96th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE6-KRB5DEVEL-2456628
  • published10 Apr 2022
  • disclosed10 Feb 2011

Introduced: 10 Feb 2011

CVE-2011-0282  (opens in a new tab)

How to fix?

Upgrade Oracle:6 krb5-devel to version 0:1.8.2-3.el6_0.4 or higher.
This issue was patched in ELSA-2011-0200.

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-devel package and not the krb5-devel package as distributed by Oracle. See How to fix? for Oracle:6 relevant fixed versions and status.

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read, and daemon crash) via a crafted principal name.

CVSS Scores

version 3.1