CVE-2019-3467

7.8HIGH

Key Information

Vendor
Debian
Status
Debian Edu
Vendor
CVE Published:
23 December 2019

Summary

Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.

Affected Version(s)

Debian Edu = all versions < 2.11.10

References

https://lists.debian.org/debian-lts-announce/2019/12/msg0...
mailing-listx_refsource_MLIST
https://seclists.org/bugtraq/2019/Dec/34
mailing-listx_refsource_BUGTRAQ
https://www.debian.org/security/2019/dsa-4589
vendor-advisoryx_refsource_DEBIAN

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.