Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2017-7562

Quick assessment

Affected
MIT krb5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MIT krb5（又名MIT Kerberos 5）是美国麻省理工（Massachusetts Institute Of Technology）大学的一套网络认证协议，它采用客户端/服务器结构，并且客户端和服务器端均可对对方进行身份认证（即双重验证），可防止窃听、防止replay攻击等。 MIT krb5 1.16.1之前版本存在信任管理问题漏洞。远程攻击者利用该漏洞获取未授权的访问权限或绕过安全限制。

AI Predicted 9.1 Difficulty: Moderate EPSS 3.18% · P88
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2017-7562

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
MIT krb5 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MIT krb5（又名MIT Kerberos 5）是美国麻省理工（Massachusetts Institute Of Technology）大学的一套网络认证协议，它采用客户端/服务器结构，并且客户端和服务器端均可对对方进行身份认证（即双重验证），可防止窃听、防止replay攻击等。 MIT krb5 1.16.1之前版本存在信任管理问题漏洞。远程攻击者利用该漏洞获取未授权的访问权限或绕过安全限制。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
MIT krb5 1.16.1 -

II. Public POCs for CVE-2017-7562

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2017-7562

请登录查看更多情报信息。

Patches & Fixes for CVE-2017-7562 (4)

Vendor Advisories for CVE-2017-7562 (3)

IV. Related Vulnerabilities

Same product: krb5
Same vendor: MIT
Same weakness: CWE-295

V. Comments for CVE-2017-7562

No comments yet

Leave a comment