CVE-2010-4020

Publication date 2 December 2010

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
krb5	10.10 maverick	Fixed 1.8.1+dfsg-5ubuntu0.2
	10.04 LTS lucid	Fixed 1.8.1+dfsg-2ubuntu0.4
	9.10 karmic	Not affected
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not affected

Notes

mdeslaur

1.8 and newer

Severity score breakdown

Parameter	Value
Base score	6.3 · Medium
Attack vector	Network
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	Low
Availability impact	Low
Vector	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References

Related Ubuntu Security Notices (USN)

USN-1030-1
Kerberos vulnerabilities
9 December 2010