CVE-2010-1322: mit kerberos_5 Improper Input Validation
Vulnerability summary
CVE-2010-1322 is a medium (CVSS 6.5) Improper Input Validation vulnerability in mit kerberos_5. EPSS estimates a 3.04% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 07-10-2010PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
The merge_authdata function in kdc_authdata.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x before 1.8.4 does not properly manage an index into an authorization-data list, which allows remote attackers to cause a denial of service (daemon crash), or possibly obtain sensitive information, spoof authorization, or execute arbitrary code, via a TGS request that triggers an uninitialized pointer dereference, as demonstrated by a request from a Windows Active Directory client.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.04%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 3.04% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat8 products
- krb5< 0:1.8.2-3.el6_0.1
- krb5-debuginfo< 0:1.8.2-3.el6_0.1
- krb5-devel< 0:1.8.2-3.el6_0.1
- krb5-libs< 0:1.8.2-3.el6_0.1
- krb5-pkinit-openssl< 0:1.8.2-3.el6_0.1
Debian1 product
- krb5< 1.8.3+dfsg-2
Mit1 product
- kerberos_51.8 | 1.8.1 | 1.8.2 | 1.8.3
3 vendors · 10 products
