Kerberos密钥分发中心远程拒绝服务漏洞发布时间：2003-02-12 更新时间：2003-02-12 严重程度：高 威胁程度：远程拒绝服务 错误类型：边界检查错误 利用方式：服务器模式 BUGTRAQ ID：6683 受影响系统 MIT Kerberos 5 1.2.1详细描述 Kerberos密钥分发中心(Kerberos Key Distribution Center,KDC)实现上存在拒绝服务攻击漏洞，一个已经通过认证的攻击者可以通过一个恶意的Ticket Granting请求远程导致KDC服务崩溃。此漏洞影响到KDC 1.2.5之前的版本。 解决方案 厂商已经在新版软件中修补了此漏洞： MIT Upgrade Kerberos 1.2.5 http://web.mit.edu/kerberos/www/krb5-1.2/index.html Sun SEAM (Sun Enterprise Authentication Mechanism) 1.0: Sun Upgrade 112534-02 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112534&rev=02 For Solaris 2.6 Sun Upgrade 112536-02 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112536&rev=02 For Solaris 7.0 Sun Upgrade 112535-02 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112535&rev=02 For Solaris 2.6 x86 Sun Upgrade 112537-03 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112537&rev=03 For Solaris 7.0 x86 Sun Solaris 8.0 _x86: Sun Upgrade 112238-06 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112238&rev=06 Global Patch Sun Upgrade 112240-06 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112240&rev=06 Domestic Patch Sun Solaris 8.0: Sun Upgrade 112237-07 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112237&rev=07 Global Patch Sun Upgrade 112390-07 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112390&rev=07 Domestic Patch Sun Solaris 9.0: Sun Upgrade 112908-04 http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=112908&rev=04 相关信息 Greg Pryzby和Ken Raeburn Several Kerberos Applications are Vulnerable to a Denial of Service (DoS) http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert%2F50142 Vulnerability Note VU#661243 http://www.kb.cert.org/vuls/id/661243 |
