Description
The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (aka "buffer underrun").
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.3.3-2 | — |
| Debian 13 | krb5 | 1.3.3-2 | — |
| Debian 12 | krb5 | 1.3.3-2 | — |
| Debian 3.0 | krb5 | 1.2.4-5woody4 | DSA-266 |
Advisories 1
- DSA-266 krb5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:052 vendor-advisory
- 20030331 GLSA: krb5 & mit-krb5 (200303-28) mailing-list
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt
- 7185 vdb-entry
- RHSA-2003:091 vendor-advisory
- oval:org.mitre.oval:def:4430 vdb-entry signature
- oval:org.mitre.oval:def:244 vdb-entry signature
- RHSA-2003:051 vendor-advisory
- DSA-266 vendor-advisory
- 54042 vendor-advisory
- oval:org.mitre.oval:def:2536 vdb-entry signature