Description
Unknown vulnerability in the chk_trans.c of the libkrb5 library for MIT Kerberos V5 before 1.2.5 allows users from one realm to impersonate users in other realms that have the same inter-realm keys.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.2.5-1 | — |
| Debian 13 | krb5 | 1.2.5-1 | — |
| Debian 12 | krb5 | 1.2.5-1 | — |
References
- RHSA-2003:052 vendor-advisory
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt
- CLSA-2003:639 vendor-advisory
- RHSA-2003:051 vendor-advisory
- MDKSA-2003:043 vendor-advisory
- 6714 vdb-entry
- kerberos-kdc-user-spoofing(11188) vdb-entry
- VU#684563 third-party-advisory
- RHSA-2003:168 vendor-advisory