CVE-2003-0072 The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain proto...
MediumCVSS 5.0
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (aka "array overrun").
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos | = 1.0 | No fix listed |
| mit kerberos | = 1.2.2.beta1 | No fix listed |
| mit kerberos 5 | = 1.0.6 | No fix listed |
| mit kerberos 5 | = 1.1 | No fix listed |
| mit kerberos 5 | = 1.1.1 | No fix listed |
| mit kerberos 5 | = 1.2 | No fix listed |
| mit kerberos 5 | = 1.2.1 | No fix listed |
| mit kerberos 5 | = 1.2.2 | No fix listed |
| mit kerberos 5 | = 1.2.3 | No fix listed |
| mit kerberos 5 | = 1.2.4 | No fix listed |
| mit kerberos 5 | = 1.2.5 | No fix listed |
| mit kerberos 5 | = 1.2.6 | No fix listed |
| mit kerberos 5 | = 1.2.7 | No fix listed |
| mit kerberos 5 | = 1.3-alpha1 | No fix listed |
| debian/krb5(Debian:12) | < 1.2.7-3 | 1.2.7-3 |
| debian/krb5(Debian:13) | < 1.2.7-3 | 1.2.7-3 |
| debian/krb5(Debian:14) | < 1.2.7-3 | 1.2.7-3 |
References
- 54042 vendor-advisory
- web.mit.edu patch vendor-advisory
- DSA-266 patch vendor-advisory
- RHSA-2003:051 vendor-advisory
- RHSA-2003:052 vendor-advisory
- 20030331 GLSA: krb5 & mit-krb5 (200303-28) mailing-list
- 7184 vdb-entry
- Debian Security Tracker CVE-2003-0072 vendor-advisory