CVE-2003-0139 Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tic...
HighCVSS 7.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos | = 4 | No fix listed |
| debian/krb5(Debian:12) | < 1.2.7-3 | 1.2.7-3 |
| debian/krb5(Debian:13) | < 1.2.7-3 | 1.2.7-3 |
| debian/krb5(Debian:14) | < 1.2.7-3 | 1.2.7-3 |
References
- 20030319 MITKRB5-SA-2003-004: Cryptographic weaknesses in Kerberos v4 mailing-list
- web.mit.edu patch vendor-advisory
- DSA-266 vendor-advisory
- DSA-273 vendor-advisory
- VU#442569 patch third-party-advisory us-government-resource
- RHSA-2003:051 vendor-advisory
- RHSA-2003:052 vendor-advisory
- RHSA-2003:091 vendor-advisory
- 20030331 GLSA: krb5 & mit-krb5 (200303-28) mailing-list
- 20030330 GLSA: openafs (200303-26) mailing-list
- oval:org.mitre.oval:def:250 signature vdb-entry
- Debian Security Tracker CVE-2003-0139 vendor-advisory