Summary
The remote host is missing an update to krb5
announced via advisory DSA 2052-1.
Solution
https://secure1.securityspace.com/smysecure/catid.html?in=DSA%202052-1
Insight
Shawn Emery discovered that in MIT Kerberos 5 (krb5), a system for authenticating users and services on a network, a null pointer dereference flaw in the Generic Security Service Application Program Interface (GSS-API) library could allow an authenticated remote attacker to crash any server application using the GSS-API authentication mechanism, by sending a specially-crafted GSS-API token with a missing checksum field.
For the stable distribution (lenny), this problem has been fixed in version 1.6.dfsg.4~beta1-5lenny4.
For the testing distribution (squeeze), this problem has been fixed in version 1.8.1+dfsg-3.
For the testing distribution (sid), this problem has been fixed in version 1.8.1+dfsg-3.
We recommend that you upgrade your krb5 packages.
Severity
Classification
-
CVE CVE-2010-1321 -
CVSS Base Score: 6.8
AV:N/AC:L/Au:S/C:N/I:N/A:C
Related Vulnerabilities