CVE-2024-37370: High severity MIT Kerberos 5 vulnerability
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
Other sources
MIT Kerberos 5 (aka krb5) could allow a remote attacker to bypass security restrictions, caused by improper access control. By sending a specially crafted request to modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, an attacker could exploit this vulnerability to cause the unwrapped token to appear truncated to the application.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37370?
CVE-2024-37370 is considered a medium severity vulnerability due to its potential impact on data confidentiality.
How do I fix CVE-2024-37370?
To fix CVE-2024-37370, upgrade to versions 1.21.3 or later of MIT Kerberos 5.
What software is affected by CVE-2024-37370?
CVE-2024-37370 affects MIT Kerberos 5 versions prior to 1.21.3 and IBM QRadar SIEM versions up to 7.5.0 UP9 IF03.
What type of attack does CVE-2024-37370 facilitate?
CVE-2024-37370 allows an attacker to modify the plaintext Extra Count field of a GSS krb5 wrap token.
What are the implications of CVE-2024-37370 for applications using Kerberos?
Applications using Kerberos may incorrectly interpret truncated unwrapped tokens, potentially leading to confidentiality issues.