CVE-2010-4020

MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1)…

published December 2, 2010

CVSS
—
EPSS
2%
Percentile
79.7
In the wild
Unconfirmed
What it is

MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01916 · 79.7th percentile
Published
2010-12-02T16:00Z
EPSS history
Timeline
  • 02 DEC 16:00Z
    MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1)…
    cvelistv5