FreeBSD : krb5 -- RFC 3961 key-derivation checksum handling vulnerability (1d193bba-03f6-11e0-bf50-001a926c7637)

Low Nessus Plugin ID 51102


The remote FreeBSD host is missing a security-related update.


The MIT Kerberos team reports :

MIT krb5 (releases incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH and AD-KDC-ISSUED authorization data.

An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the AD-SIGNEDPATH signature if the TGT key is RC4, allowing it to use self-generated 'evidence' tickets for S4U2Proxy, instead of tickets obtained from the user or with S4U2Self. Configurations using RC4 for the TGT key are believed to be rare.

An authenticated remote attacker has a 1/256 chance of forging AD-KDC-ISSUED signatures on authdata elements in tickets having an RC4 service key, resulting in privilege escalation against a service that relies on these signatures. There are no known uses of the KDC-ISSUED authdata container at this time.


Update the affected package.

See Also

Plugin Details

Severity: Low

ID: 51102

File Name: freebsd_pkg_1d193bba03f611e0bf50001a926c7637.nasl

Version: $Revision: 1.10 $

Type: local

Published: 2010/12/10

Modified: 2016/12/08

Dependencies: 12634

Risk Information

Risk Factor: Low


Base Score: 3.5

Temporal Score: 2.7

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:P/A:N

Temporal Vector: CVSS2#E:POC/RL:OF/RC:C


Base Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:krb5, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2010/12/09

Vulnerability Publication Date: 2010/11/30

Reference Information

CVE: CVE-2010-4020

BID: 45117

OSVDB: 69608