CVE-2010-1324

MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.

• CWE-310

• http://kb.vmware.com/kb/1035108
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
• http://lists.vmware.com/pipermail/security-announce/2011/000133.html
• http://marc.info/?l=bugtraq&m=129562442714657&w=2
• http://osvdb.org/69609
• http://secunia.com/advisories/42399Vendor Advisory
• http://secunia.com/advisories/43015
• http://support.apple.com/kb/HT4581
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txtVendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:246
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Vendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0925.html
• http://www.securityfocus.com/archive/1/514953/100/0/threaded
• http://www.securityfocus.com/archive/1/517739/100/0/threaded
• http://www.securityfocus.com/bid/45116
• http://www.securitytracker.com/id?1024803
• http://www.ubuntu.com/usn/USN-1030-1
• http://www.vmware.com/security/advisories/VMSA-2011-0007.html
• http://www.vupen.com/english/advisories/2010/3094
• http://www.vupen.com/english/advisories/2010/3095
• http://www.vupen.com/english/advisories/2010/3118
• http://www.vupen.com/english/advisories/2011/0187
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936
• http://kb.vmware.com/kb/1035108
• http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html
• http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
• http://lists.vmware.com/pipermail/security-announce/2011/000133.html
• http://marc.info/?l=bugtraq&m=129562442714657&w=2
• http://osvdb.org/69609
• http://secunia.com/advisories/42399Vendor Advisory
• http://secunia.com/advisories/43015
• http://support.apple.com/kb/HT4581
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txtVendor Advisory
• http://www.mandriva.com/security/advisories?name=MDVSA-2010:246
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.htmlPatch, Vendor Advisory
• http://www.redhat.com/support/errata/RHSA-2010-0925.html
• http://www.securityfocus.com/archive/1/514953/100/0/threaded
• http://www.securityfocus.com/archive/1/517739/100/0/threaded
• http://www.securityfocus.com/bid/45116
• http://www.securitytracker.com/id?1024803
• http://www.ubuntu.com/usn/USN-1030-1
• http://www.vmware.com/security/advisories/VMSA-2011-0007.html
• http://www.vupen.com/english/advisories/2010/3094
• http://www.vupen.com/english/advisories/2010/3095
• http://www.vupen.com/english/advisories/2010/3118
• http://www.vupen.com/english/advisories/2011/0187
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936

Published

Dec 2, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-1318Stack-based buffer overflow in the AgentX::receive_agentx fu…
• CVE-2010-1319Integer overflow in the AgentX::receive_agentx function in A…
• CVE-2010-1320Double free vulnerability in do_tgs_req.c in the Key Distrib…
• CVE-2010-1321The kg_accept_krb5 function in krb5/accept_sec_context.c in …
• CVE-2010-1322The merge_authdata function in kdc_authdata.c in the Key Dis…
• CVE-2010-1323MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x,…
• CVE-2010-1325Cross-site request forgery (CSRF) vulnerability in the apach…
• CVE-2010-1326perms.cpp in March Hare Software CVSNT 2.0.58, 2.5.01, 2.5.0…
• CVE-2010-1327Multiple SQL injection vulnerabilities in TornadoStore 1.4.3…
• CVE-2010-1328Multiple cross-site scripting (XSS) vulnerabilities in Torna…
• CVE-2010-1329Imperva SecureSphere Web Application Firewall and Database F…
• CVE-2010-1330The regular expression engine in JRuby before 1.4.1, when $K…