CVE-2001-1444 The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption options sent from the server, which allows remote attackers to....
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption options sent from the server, which allows remote attackers to downgrade authentication and encryption mechanisms via a man-in-the-middle attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kth kerberos | = 4 | No fix listed |
| kth kerberos | = 5 | No fix listed |
References
- josefsson.org exploit
- VU#774587 third-party-advisory us-government-resource
- kth-kerberos-unencrypted-connection(10640) vdb-entry