« Volver al listado

CVE-2012-1012

Estado: ModificadaMedia (5.5)—

server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

MIT — Kerberos 5

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2012-1012",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-06-07T19:55:07.757",
  "references": [
    {
      "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7093",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://src.mit.edu/fisheye/changelog/krb5/?cs=25704",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://web.mit.edu/kerberos/krb5-1.10/",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=796438",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7093",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://src.mit.edu/fisheye/changelog/krb5/?cs=25704",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://web.mit.edu/kerberos/krb5-1.10/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=796438",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege."
    },
    {
      "lang": "es",
      "value": "server/server_stubs.c en la implementación del protocolo kadmin en MIT Kerberos 5 (también conocido como krb5) v1.10 antes de v1.10.1 no restringe debidamente el acceso a las operaciones (1) SET_STRING y (2) GET_STRINGS, lo que podría permitir modificar o leer atributos de cadena a los administradores remotos autenticados al aprovechar el privilegio \"global list\"."
    }
  ],
  "lastModified": "2026-06-16T23:38:48.090",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FC504264-A9E9-4433-B7AA-6D5015A93FF3"
            },
            {
              "criteria": "cpe:2.3:a:mit:kerberos_5:1.10.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "77FA352F-520C-4C05-AD52-FC8586DB16B1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}