Description
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.9.1+dfsg-1 | — |
| Debian 13 | krb5 | 1.9.1+dfsg-1 | — |
| Debian 12 | krb5 | 1.9.1+dfsg-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | krb5 +6 | 1.8.2-3.el6_0.7 | RHSA-2011:0447 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | krb5 | 1.15-1.1 | openSUSE-SU-2024:10004-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- MIT Kerberos 5 - kadmind Change Password Feature Remote Code Execution EDB-35606 · remote · Apr 11, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- RHSA-2011:0447 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10004-1 krb5-1.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 20110413 MITKRB5-SA-2011-004 kadmind invalid pointer free() [CVE-2011-0285] mailing-list
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt
- RHSA-2011:0447 vendor-advisory
- 47310 vdb-entry
- 44181 third-party-advisory
- 1025320 vdb-entry
- openSUSE-SU-2011:0348 vendor-advisory
- 44125 third-party-advisory
- 44196 third-party-advisory
- ADV-2011-0997 vdb-entry
- 71789 vdb-entry
- ADV-2011-0936 vdb-entry
- MDVSA-2011:077 vendor-advisory
- ADV-2011-0986 vdb-entry
- 8200 third-party-advisory
- FEDORA-2011-5333 vendor-advisory
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=6899
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621726