Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.1

MIT Kerberos 5 (krb5) 1.7 allows remote users to impersonate others

CVE-2010-4021 · published 15 years ago
Summary

A security issue in MIT Kerberos 5 version 1.7 allows a remote authenticated user to pretend to be someone else. This could happen if a user is tricked into making a request that the attacker can then alter. To stay safe, update to a newer version of MIT Kerberos 5.

What to do
  • Update debian krb5 to version 1.8+dfsg~alpha1-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian krb5 < 1.8+dfsg~alpha1-1
Fix: upgrade to 1.8+dfsg~alpha1-1
Debian:12 debian krb5 < 1.8+dfsg~alpha1-1
Fix: upgrade to 1.8+dfsg~alpha1-1
Debian:13 debian krb5 < 1.8+dfsg~alpha1-1
Fix: upgrade to 1.8+dfsg~alpha1-1
Debian:14 debian krb5 < 1.8+dfsg~alpha1-1
Fix: upgrade to 1.8+dfsg~alpha1-1
– mit kerberos_5 1.7
cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*
Original advisory text
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS requests, which might allow remote authenticated users to i...
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS requests, which might allow remote authenticated users to impersonate a client by rewriting an inner request, aka a "KrbFastReq forgery issue."
References
Severity
2.1 Low
Exploitation
2% chance of attack within 30 days
Type
CWE-16Configuration
CWE-264Permissions, Privileges, and Access Controls
Timeline
Published2 Dec 2010
Updated4 Nov 2026
First seen15 Aug 2026
Sources
DEBIAN-CVE-2010-4021 · OSV
CVE-2010-4021 · NVD
Track software like this
Free during beta