CVE-2012-1012

Description

server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege.

How to fix CVE-2012-1012

To remediate CVE-2012-1012, upgrade the affected package to a fixed version below.

• Debian/krb5—upgrade to 1.10.1+dfsg-1 or later

Is CVE-2012-1012 being exploited?

Low — EPSS is 0.2%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 1.10.1+dfsg-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2012-1012