MIT Kerberos 5 kadmind CVE-2002-2443 Remote Denial of Service Vulnerability
BID:60008
Info
MIT Kerberos 5 kadmind CVE-2002-2443 Remote Denial of Service Vulnerability
| Bugtraq ID: | 60008 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: |
CVE-2002-2443 |
| Remote: | Yes |
| Local: | No |
| Published: | May 14 2013 12:00AM |
| Updated: | Apr 13 2015 09:46PM |
| Credit: | Tom Yu |
| Vulnerable: |
Sun Solaris 10_x86 Sun Solaris 10_sparc RedHat Enterprise Linux Desktop Workstation 5 client Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 MIT Kerberos 5 1.8.3 MIT Kerberos 5 1.10.1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 SP1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Proactive Contact 5.0 Avaya Meeting Exchange 6.0 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.0 SP3 Avaya Aura System Platform 6.0 SP2 Avaya Aura System Platform 6.0 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura Session Manager 6.2.1 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 SP2 Avaya Aura Session Manager 6.1 Sp1 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0 SP1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 SP2 Avaya Aura Session Manager 5.2 SP1 Avaya Aura Session Manager 5.2 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Messaging 6.1 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Conferencing 6.0 Standard Avaya Aura Conferencing 6.0 SP1 Standard Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Application Server 5300 SIP Core 2.1 Avaya Aura Application Server 5300 SIP Core 2.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 |
| Not Vulnerable: | |
Discussion
MIT Kerberos 5 kadmind CVE-2002-2443 Remote Denial of Service Vulnerability
MIT Kerberos 5 is prone to a remote denial-of-service vulnerability in 'kadmind'.
Attackers can exploit this issue to consume network bandwidth and CPU resources, denying service to legitimate users.
MIT Kerberos 5 1.8.3 and 1.10.1 are vulnerable; other versions may also be affected.
MIT Kerberos 5 is prone to a remote denial-of-service vulnerability in 'kadmind'.
Attackers can exploit this issue to consume network bandwidth and CPU resources, denying service to legitimate users.
MIT Kerberos 5 1.8.3 and 1.10.1 are vulnerable; other versions may also be affected.
Exploit / POC
MIT Kerberos 5 kadmind CVE-2002-2443 Remote Denial of Service Vulnerability
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
Solution / Fix
MIT Kerberos 5 kadmind CVE-2002-2443 Remote Denial of Service Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
MandrakeSoft Enterprise Server 5
Solution:
Updates are available. Please see the references or vendor advisory for more information.
MandrakeSoft Enterprise Server 5
-
Mandriva krb5-1.8.1-0.11mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva krb5-pkinit-openssl-1.8.1-0.11mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva krb5-server-1.8.1-0.11mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva krb5-server-ldap-1.8.1-0.11mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva krb5-workstation-1.8.1-0.11mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libkrb53-1.8.1-0.11mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva libkrb53-devel-1.8.1-0.11mdvmes5.2.i586.rpm
http://www.mandriva.com/en/downloads/
References
MIT Kerberos 5 kadmind CVE-2002-2443 Remote Denial of Service Vulnerability
References:
References:
- CVE-2002-2443 Denial of Service vulnerability in Kerberos (Oracle)
- Debian Bug report logs - #708267 (Benjamin Kaduk)
- ESA-2014-016: EMC VPLEX Multiple Vulnerabilities (EMC)
- Kerberos Homepage (MIT)
- RT/krbdev.mit.edu: Ticket #7637 Fix kpasswd UDP ping-pong [CVE-2002-2443] (tlyu)
- krb5 security update (RHSA-2013-0942) (Avaya)
- Wind River Linux krb5 Security Update (WIND00419898) (Avaya)
- Wind River WIND00419898 (Wind River)