Networks

Ask something
Discussion Locked

Kerberos under Attack ? maybe..

0 helpful
1 reply

by fazmin.nizam

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We all know The Kerberos authentication protocol is intended to make networks more secure, Recently I read or someone told me that, a security hole in the mod_auth_kerb Apache module has made Kerberos prone to attacks. Attackers could used specially prepared Kerberos queries to crash web servers with version 5.0, 5.1 installed, the attacker might also be able plant and execute arbitrary code. Still not clear although other versions of the module may also potentially be affected. Anyone have more information regarding this please share

1 reply

by nofxforever

There has recently been a problem identified with the module
NVD:
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-5989
Secunia
http://secunia.com/advisories/23023
This allowed for a DoS attack, yes crashing the servers. However, attacks of any measure are almost common and this one is no different then 10 or 20 I could name in IIS or the actual Apache server.

Also it seems to have been patched in cvs so now it is no longer a concern. However, there is a stack based buffer overflow chance, however, there seems to be no good exploits for this.
This was given a fairly low rating by both services, and I would just recommending updating your software.

This discussion is closed to new replies.