Upstream information

CVE-2010-0628 at MITRE

Description

The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.

SUSE information

CVSS v2 Scores
  National Vulnerability Database
Base Score 4.96
Vector AV:N/AC:L/Au:N/C:N/I:N/A:P
Access Vector Network
Access Complexity Low
Authentication None
Confidentiality Impact None
Integrity Impact None
Availability Impact Partial
SUSE Bugzilla entries: 582557 [RESOLVED / FIXED], 586981 [RESOLVED / DUPLICATE]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
openSUSE 11.2
  • krb5-apps-clients-debuginfo >= 1.7-6.4.1
  • krb5-apps-servers-debuginfo >= 1.7-6.4.1
  • krb5-client-debuginfo >= 1.7-6.4.1
  • krb5-debuginfo >= 1.7-6.4.1
  • krb5-debuginfo-32bit >= 1.7-6.4.1
  • krb5-debugsource >= 1.7-6.4.1
  • krb5-mini-debuginfo >= 1.7-6.4.1
  • krb5-mini-debugsource >= 1.7-6.4.1
  • krb5-plugin-kdb-ldap-debuginfo >= 1.7-6.4.1
  • krb5-plugin-preauth-pkinit-debuginfo >= 1.7-6.4.1
  • krb5-server-debuginfo >= 1.7-6.4.1
openSUSE 11.2
  • krb5 >= 1.7-6.4.1
  • krb5-32bit >= 1.7-6.4.1
  • krb5-apps-clients >= 1.7-6.4.1
  • krb5-apps-servers >= 1.7-6.4.1
  • krb5-client >= 1.7-6.4.1
  • krb5-devel >= 1.7-6.4.1
  • krb5-devel-32bit >= 1.7-6.4.1
  • krb5-mini >= 1.7-6.4.1
  • krb5-mini-devel >= 1.7-6.4.1
  • krb5-plugin-kdb-ldap >= 1.7-6.4.1
  • krb5-plugin-preauth-pkinit >= 1.7-6.4.1
  • krb5-server >= 1.7-6.4.1