CVE-2003-0138 Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.
HighCVSS 7.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos | = 4 | No fix listed |
| debian/heimdal(Debian:12) | < 0.5.2-1 | 0.5.2-1 |
| debian/heimdal(Debian:13) | < 0.5.2-1 | 0.5.2-1 |
| debian/heimdal(Debian:14) | < 0.5.2-1 | 0.5.2-1 |
| debian/krb5(Debian:12) | < 1.2.7-3 | 1.2.7-3 |
| debian/krb5(Debian:13) | < 1.2.7-3 | 1.2.7-3 |
| debian/krb5(Debian:14) | < 1.2.7-3 | 1.2.7-3 |
References
- 20030317 MITKRB5-SA-2003-004: Cryptographic weaknesses in Kerberos v4 protocol mailing-list
- web.mit.edu patch vendor-advisory
- DSA-266 patch vendor-advisory
- DSA-269 vendor-advisory
- DSA-273 vendor-advisory
- VU#623217 patch third-party-advisory us-government-resource
- RHSA-2003:051 vendor-advisory
- RHSA-2003:052 vendor-advisory
- RHSA-2003:091 vendor-advisory
- 20030331 GLSA: krb5 & mit-krb5 (200303-28) mailing-list
- 7113 vdb-entry
- oval:org.mitre.oval:def:248 signature vdb-entry
- Debian Security Tracker CVE-2003-0138 vendor-advisory