Description
MIT Kerberos V5 Key Distribution Center (KDC) before 1.2.5 allows remote authenticated attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that causes a null dereference.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.2.5-1 | — |
| Debian 13 | krb5 | 1.2.5-1 | — |
| Debian 12 | krb5 | 1.2.5-1 | — |
References
- RHSA-2003:052 vendor-advisory
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt
- CLSA-2003:639 vendor-advisory
- RHSA-2003:051 vendor-advisory
- MDKSA-2003:043 vendor-advisory
- oval:org.mitre.oval:def:1110 vdb-entry signature
- kerberos-kdc-null-pointer-dos(10099) vdb-entry
- VU#661243 third-party-advisory
- 50142 vendor-advisory
- 6683 vdb-entry
- RHSA-2003:168 vendor-advisory