NVD Vulnerability Detail

CVE-2018-20217

Summary	A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
Publication Date	Dec. 27, 2018, 6:29 a.m.
Registration Date	March 1, 2021, 7:16 p.m.
Last Update	Nov. 21, 2024, 1:01 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:mit:kerberos::::::::					5-1.17

Related information, measures and tools

No	URL	タグ
1	http://krbdev.mit.edu/rt/Ticket/Display.html?id=8763	Patch Third Party Advisory
2	http://krbdev.mit.edu/rt/Ticket/Display.html?id=8763	Patch Third Party Advisory
3	https://github.com/krb5/krb5/commit/5e6d1796106df8ba6bc1973ee0917c170d929086	Patch Third Party Advisory
4	https://github.com/krb5/krb5/commit/5e6d1796106df8ba6bc1973ee0917c170d929086	Patch Third Party Advisory
5	https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html	Mailing List Third Party Advisory
6	https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html	Mailing List Third Party Advisory
7	https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html	Mailing List Third Party Advisory
8	https://lists.debian.org/debian-lts-announce/2021/09/msg00019.html	Mailing List Third Party Advisory
9	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KNHELH4YHNT6H2ESJWX2UIDXLBNGB2O/
10	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KNHELH4YHNT6H2ESJWX2UIDXLBNGB2O/
11	https://security.netapp.com/advisory/ntap-20190416-0006/	Third Party Advisory
12	https://security.netapp.com/advisory/ntap-20190416-0006/	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-617	到達可能なアサーション	https://cwe.mitre.org/data/definitions/617.html

JVN Vulnerability Information

MIT Kerberos 5 における入力確認に関する脆弱性

Title	MIT Kerberos 5 における入力確認に関する脆弱性
Summary	MIT Kerberos 5 (別名 krb5) には、入力確認に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 3, 2018, midnight
Registration Date	March 14, 2019, 4:26 p.m.
Last Update	March 14, 2019, 4:26 p.m.

Affected System

MIT Kerberos

Kerberos 1.17 未満

Debian

Debian GNU/Linux

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-20217	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20217
2	CVE-2018-20217	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20217
National Vulnerability Database (NVD)
3	CVE-2018-20217	https://nvd.nist.gov/vuln/detail/CVE-2018-20217
4	CVE-2018-20217	https://nvd.nist.gov/vuln/detail/CVE-2018-20217

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html
2	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Debian
1	[SECURITY] [DLA 1643-1] krb5 security update	https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html
2	[SECURITY] [DLA 1643-1] krb5 security update	https://lists.debian.org/debian-lts-announce/2019/01/msg00020.html
GitHub
3	Ignore password attributes for S4U2Self requests	https://github.com/krb5/krb5/commit/5e6d1796106df8ba6bc1973ee0917c170d929086
4	Ignore password attributes for S4U2Self requests	https://github.com/krb5/krb5/commit/5e6d1796106df8ba6bc1973ee0917c170d929086
RT/krbdev.mit.edu
5	Ticket #8763 Ignore password attributes for S4U2Self requests	http://krbdev.mit.edu/rt/Ticket/Display.html?id=8763
6	Ticket #8763 Ignore password attributes for S4U2Self requests	http://krbdev.mit.edu/rt/Ticket/Display.html?id=8763

Change Log

No	Changed Details	Date of change
1	[2019年03月14日] 掲載	March 14, 2019, 4:26 p.m.