Description
Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗Advisories 2
- DSA-273 krb4 - Cryptographic weakness Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-266 krb5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2003:052 vendor-advisory
- 20030331 GLSA: krb5 & mit-krb5 (200303-28) mailing-list
- VU#442569 third-party-advisory
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-004-krb4.txt
- RHSA-2003:091 vendor-advisory
- DSA-273 vendor-advisory
- oval:org.mitre.oval:def:250 vdb-entry signature
- RHSA-2003:051 vendor-advisory
- 20030319 MITKRB5-SA-2003-004: Cryptographic weaknesses in Kerberos v4 mailing-list
- DSA-266 vendor-advisory
- 20030330 GLSA: openafs (200303-26) mailing-list