| Vulnerability Name: | CVE-2011-0043 (CCN-64900) | ||||||||
| Assigned: | 2010-12-10 | ||||||||
| Published: | 2011-02-08 | ||||||||
| Updated: | 2019-02-26 | ||||||||
| Summary: | Kerberos in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 supports weak hashing algorithms, which allows local users to gain privileges by operating a service that sends crafted service tickets, as demonstrated by the CRC32 algorithm, aka "Kerberos Unkeyed Checksum Vulnerability." | ||||||||
| CVSS v3 Severity: | 8.2 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C) 5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-310 | ||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||
| References: | Source: MITRE Type: CNA CVE-2011-0043 Source: OSVDB Type: UNKNOWN 70834 Source: CCN Type: SA43251 Microsoft Windows Kerberos Unkeyed Checksum Privilege Escalation Vulnerability Source: SECUNIA Type: Vendor Advisory 43251 Source: CONFIRM Type: UNKNOWN http://support.avaya.com/css/P8/documents/100127250 Source: CCN Type: Microsoft Security Bulletin MS12-069 Vulnerability in Kerberos Could Allow Denial of Service (2743555) Source: CCN Type: Microsoft Security Bulletin MS14-068 Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) Source: CCN Type: Microsoft Security Bulletin MS15-122 Security Update for Kerberos to Address Security Feature Bypass (3105256) Source: CCN Type: Microsoft Security Bulletin MS15-132 Security Update for Microsoft Windows to Address Remote Code Execution (3116162) Source: CCN Type: Microsoft Security Bulletin MS16-008 Security Update for Kernel to Address Elevation of Privilege (3124605) Source: CCN Type: Microsoft Security Bulletin MS16-014 Security update for Microsoft Windows to Address Remote Code Execution (3134228) Source: CCN Type: Microsoft Security Bulletin MS16-031 Security Update for Microsoft Windows to Address Elevation of Privilege (3140410) Source: CCN Type: Microsoft Security Bulletin MS16-044 Security Update for Windows OLE (3146706) Source: CCN Type: Microsoft Security Bulletin MS16-047 Security Update for SAM and LSAD Remote Protocols (3148527) Source: CCN Type: Microsoft Security Bulletin MS16-048 Security Update for CSRSS (3148528) Source: CCN Type: Microsoft Security Bulletin MS16-060 Security Update for Windows Kernel (3154846) Source: CCN Type: Microsoft Security Bulletin MS16-061 Security Update for Microsoft RPC (3155520) Source: CCN Type: Microsoft Security Bulletin MS16-075 Security Update for Windows SMB Server (3164038) Source: CCN Type: Microsoft Security Bulletin MS16-076 Security Update for Netlogon (3167691) Source: CCN Type: Microsoft Security Bulletin MS16-092 Security Update for Windows Kernel (3171910) Source: CCN Type: Microsoft Security Bulletin MS16-101 Security Update for Windows Authentication Methods (3178465) Source: CCN Type: Microsoft Security Bulletin MS16-110 Security Update for Windows (3178467) Source: CCN Type: Microsoft Security Bulletin MS16-111 Security Update for Windows Kernel (3186973) Source: CCN Type: Microsoft Security Bulletin MS16-120 Security Update for Microsoft Graphics Component (3192884) Source: CCN Type: Microsoft Security Bulletin MS16-122 Security Update for Microsoft Video Control (3195360) Source: CCN Type: Microsoft Security Bulletin MS16-123 Security Update for Kernel-Mode Drivers (3192892) Source: CCN Type: Microsoft Security Bulletin MS16-124 Security Update for Windows Registry (3193227) Source: CCN Type: Microsoft Security Bulletin MS16-126 Security Update for Microsoft Internet Messaging API (3196067) Source: CCN Type: Microsoft Security Bulletin MS16-131 Security Update for Microsoft Video Control (3199151) Source: CCN Type: Microsoft Security Bulletin MS16-139 Security Update for Windows Kernel (3199720) Source: CCN Type: Microsoft Security Bulletin MS16-155 Security Update for .NET Framework (3205640) Source: CCN Type: Microsoft Security Bulletin MS17-006 Cumulative Security Update for Internet Explorer (4013073) Source: CCN Type: Microsoft Security Bulletin MS17-013 Security Update for Microsoft Graphics Component (4013075) Source: CCN Type: Microsoft Security Bulletin MS11-013 Vulnerabilities in Kerberos Could Allow Elevation of Privilege (2496930) Source: CCN Type: OSVDB ID: 70834 Microsoft Windows Kerberos Unkeyed Checksum Hashing Mechanism Service Ticket Forgery Source: BID Type: UNKNOWN 46130 Source: CCN Type: BID-46130 Microsoft Windows Kerberos Unkeyed Checksum Local Privilege Escalation Vulnerability Source: SECTRACK Type: UNKNOWN 1025048 Source: VUPEN Type: Vendor Advisory ADV-2011-0326 Source: MS Type: UNKNOWN MS11-013 Source: XF Type: UNKNOWN ms-kerberos-checksum-privilege-escalation(64900) Source: XF Type: UNKNOWN ms-kerberos-checksum-privilege-escalation(64900) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:12432 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||