Summary
The remote host is missing an update to the system as announced in the referenced advisory.
Solution
Update your system with the appropriate patches or software upgrades.
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt http://osvdb.org/69608
http://www.vuxml.org/freebsd/1d193bba-03f6-11e0-bf50-001a926c7637.html
Insight
The following package is affected: krb5
CVE-2010-4020
MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations.
Severity
Classification
-
CVE CVE-2010-4020 -
CVSS Base Score: 3.5
AV:N/AC:M/Au:S/C:N/I:P/A:N
Related Vulnerabilities