| Vulnerability Name: | CVE-2011-0091 (CCN-64901) | ||||||||
| Assigned: | 2010-12-21 | ||||||||
| Published: | 2011-02-08 | ||||||||
| Updated: | 2018-10-30 | ||||||||
| Summary: | Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 does not prevent a session from changing from strong encryption to DES encryption, which allows man-in-the-middle attackers to spoof network traffic and obtain sensitive information via a DES downgrade, aka "Kerberos Spoofing Vulnerability." | ||||||||
| CVSS v3 Severity: | 4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N) 4.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
1.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-287 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2011-0091 Source: OSVDB Type: UNKNOWN 70835 Source: CCN Type: SA43257 Microsoft Windows Kerberos Authentication Encryption Downgrade Vulnerability Source: SECUNIA Type: UNKNOWN 43257 Source: CONFIRM Type: UNKNOWN http://support.avaya.com/css/P8/documents/100127250 Source: CCN Type: Microsoft Security Bulletin MS12-069 Vulnerability in Kerberos Could Allow Denial of Service (2743555) Source: CCN Type: Microsoft Security Bulletin MS14-068 Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780) Source: CCN Type: Microsoft Security Bulletin MS15-122 Security Update for Kerberos to Address Security Feature Bypass (3105256) Source: CCN Type: Microsoft Security Bulletin MS15-132 Security Update for Microsoft Windows to Address Remote Code Execution (3116162) Source: CCN Type: Microsoft Security Bulletin MS16-008 Security Update for Kernel to Address Elevation of Privilege (3124605) Source: CCN Type: Microsoft Security Bulletin MS16-014 Security update for Microsoft Windows to Address Remote Code Execution (3134228) Source: CCN Type: Microsoft Security Bulletin MS16-031 Security Update for Microsoft Windows to Address Elevation of Privilege (3140410) Source: CCN Type: Microsoft Security Bulletin MS16-044 Security Update for Windows OLE (3146706) Source: CCN Type: Microsoft Security Bulletin MS16-047 Security Update for SAM and LSAD Remote Protocols (3148527) Source: CCN Type: Microsoft Security Bulletin MS16-048 Security Update for CSRSS (3148528) Source: CCN Type: Microsoft Security Bulletin MS16-060 Security Update for Windows Kernel (3154846) Source: CCN Type: Microsoft Security Bulletin MS16-061 Security Update for Microsoft RPC (3155520) Source: CCN Type: Microsoft Security Bulletin MS16-075 Security Update for Windows SMB Server (3164038) Source: CCN Type: Microsoft Security Bulletin MS16-076 Security Update for Netlogon (3167691) Source: CCN Type: Microsoft Security Bulletin MS16-092 Security Update for Windows Kernel (3171910) Source: CCN Type: Microsoft Security Bulletin MS16-101 Security Update for Windows Authentication Methods (3178465) Source: CCN Type: Microsoft Security Bulletin MS16-110 Security Update for Windows (3178467) Source: CCN Type: Microsoft Security Bulletin MS16-111 Security Update for Windows Kernel (3186973) Source: CCN Type: Microsoft Security Bulletin MS16-120 Security Update for Microsoft Graphics Component (3192884) Source: CCN Type: Microsoft Security Bulletin MS16-122 Security Update for Microsoft Video Control (3195360) Source: CCN Type: Microsoft Security Bulletin MS16-123 Security Update for Kernel-Mode Drivers (3192892) Source: CCN Type: Microsoft Security Bulletin MS16-124 Security Update for Windows Registry (3193227) Source: CCN Type: Microsoft Security Bulletin MS16-126 Security Update for Microsoft Internet Messaging API (3196067) Source: CCN Type: Microsoft Security Bulletin MS16-131 Security Update for Microsoft Video Control (3199151) Source: CCN Type: Microsoft Security Bulletin MS16-139 Security Update for Windows Kernel (3199720) Source: CCN Type: Microsoft Security Bulletin MS16-155 Security Update for .NET Framework (3205640) Source: CCN Type: Microsoft Security Bulletin MS17-006 Cumulative Security Update for Internet Explorer (4013073) Source: CCN Type: Microsoft Security Bulletin MS17-013 Security Update for Microsoft Graphics Component (4013075) Source: CCN Type: Microsoft Security Bulletin MS11-013 Vulnerabilities in Kerberos Could Allow Elevation of Privilege (2496930) Source: CCN Type: OSVDB ID: 70835 Microsoft Windows Kerberos Authentication Downgrade Weakness Source: BID Type: UNKNOWN 46140 Source: CCN Type: BID-46140 Microsoft Windows Kerberos Encryption Standard Spoofing Vulnerability Source: SECTRACK Type: UNKNOWN 1025048 Source: VUPEN Type: UNKNOWN ADV-2011-0326 Source: MS Type: UNKNOWN MS11-013 Source: XF Type: UNKNOWN ms-kerberos-spoofing(64901) Source: XF Type: UNKNOWN ms-kerberos-spoofing(64901) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:12498 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||