CVE-2024-26462

CVE-2024-26462 affects krb5 1.21.2 and is a memory-leak vulnerability in /krb5/src/kdc/ndr.c. The issue can cause memory exhaustion and potential denial of service; exploitation status is not provided in the documents, but related advisories/patches indicate upgrading to 1.21.3 or newer to mitiga...

CVE-2024-26458

CVE-2024-26458 is documented in IBM Security Bulletins as affecting IBM Application Gateway (versions 23.10–25.09) with Kerberos 5 (krb5) 1.21.2 memory leak in /krb5/src/lib/rpc/pmap_rmt.c. IBM lists remediation: update to fixed IBM Application Gateway release and container image. Upgrading via d...

CVE-2001-0554

CVE-2001-0554 affects netkit-telnetd (Telnet daemon) on BSD-based systems, via a buffer overflow in in.telnetd/telrcv handling (triggered by certain Telnet options such as AYT). OpenVAS entries describe a remote attacker potentially causing denial of service or gaining remote code execution; at l...

CVE-2024-26461

CVE-2024-26461 affects Kerberos 5 (krb5) 1.21.2, with a memory leak in /krb5/src/lib/gssapi/krb5/k5sealv3.c. Several advisories (e.g., AlmaLinux ALSA-2024:3268, Astra Linux bulletin, CBLMARINER entries) confirm the issue and indicate a patched version: krb5 1.21.3-1 (or newer). The connected docu...

CVE-2022-42898

CVE-2022-42898 concerns integer overflow in PAC parsing within MIT Kerberos 5 (krb5) via the krb5_pac_parse function in lib/krb5/krb/pac.c. Affected: krb5 before 1.19.4 and 1.20.x before 1.20.1; 32-bit platforms may trigger remote code execution in KDC, kadmind, or a GSS/Kerberos application serv...

CVE-2020-28196

CVE-2020-28196 affects MIT Kerberos 5 (krb5) prior to 1.17.2 and 1.18.x prior to 1.18.3. The vulnerability stems from unbounded recursion in the ASN.1 BER decoder (lib/krb5/asn.1/asn1_encode.c) due to no recursion limit for indefinite lengths. This can lead to denial of service due to resource ex...

CVE-2023-36054

MIT Kerberos 5 (krb5) contains a vulnerability CVE-2023-36054 where lib/kadm5/kadm_rpc_xdr.c frees an uninitialized pointer due to improper validation between n_key_data and the key_data array. A remote authenticated user can trigger a kadmind crash. Affected versions include krb5 before 1.20.2 a...

CVE-2021-37750

CVE-2021-37750 is a vulnerability in MIT Kerberos 5 (krb5) where the Key Distribution Center (KDC) can suffer a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. Affected releases include krb5 before 1.18.5 and 1.19.x before 1.19.3. The issue can cause ...

CVE-2021-36222

CVE-2021-36222 affects MIT Kerberos 5 (krb5) KDC: the ec_verify path in kdc/kdc_preauth_ec.c can trigger a NULL pointer dereference and daemon crash. The issue occurs in KDC processing for PA-ENCRYPTED-CHALLENGE data when not correctly handling a return value in certain situations, leading to a d...

CVE-2015-8630

CVE-2015-8630 affects MIT Kerberos 5 kadmind (kadmind) via kadm5_create_principal_3 and kadm5_modify_principal: if KADM5_POLICY is set and the policy name is NULL, remote authenticated users can trigger a NULL pointer dereference and kadmind crash, leading to a denial of service. Affected are kad...

CVE-2002-2443

CVE-2002-2443 affects MIT Kerberos 5 (krb5) kadmind, specifically the kpasswd service, where schpw.c does not validate incoming UDP packets. This can allow a remote attacker to cause a denial of service via a forged UDP packet that triggers a packet/communication loop, consuming CPU and bandwidth...

CVE-2018-5730

CVE-2018-5730 and CVE-2018-5729 affect MIT krb5 1.6 and later. Upstream and distributor advisories show that an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can bypass the DN container check (CVE-2018-5730) or trigger a null dereference / kadmind bypass...

CVE-2018-5729

CVE-2018-5729 (and CVE-2018-5730) affects MIT Kerberos 5 (krb5) where an authenticated kadmin user with LDAP-principal-adding rights can cause a NULL pointer dereference or bypass a DN container check by supplying crafted data or DN arguments. The issue stems from insufficient validation in the K...

CVE-2010-1321

CVE-2010-1321 affects MIT Kerberos 5’s GSS-API library (krb5) in kg_accept_krb5/accept_sec_context.c. The flaw permits remote authenticated users to cause a denial of service via an AP-REQ with a missing authenticator checksum, triggering a NULL pointer dereference and daemon crash. Affected are ...

CVE-2024-37371

CVE-2024-37371 details (krb5) : MIT Kerberos 5 (krb5) before 1.21.3 is affected. An attacker can trigger invalid memory reads during GSS token handling by sending tokens with invalid length fields, as described in multiple vendor advisories. Affected versions are krb5 up to but not including 1.21...

CVE-2024-37370

Summary: CVE-2024-37370 affects MIT Kerberos 5 (krb5) before 1.21.3. An attacker can modify the plaintext Extra Count field in a confidential GSS wrap token, causing the unwrapped token to appear truncated to the application. The issue is tied to krb5’s GSS token handling and can impact confident...

CVE-2013-1418

The CVE-2013-1418 issue affects MIT Kerberos 5 (krb5) KDC: when multiple realms are configured, setup_server_realm() can dereference NULL and crash the daemon via a crafted request, causing DoS. Remote unauthenticated access is possible per the description. Public details in connected sources con...

CVE-2016-3119

CVE-2016-3119 affects MIT Kerberos 5 (krb5) kadmind LDAP KDB module. The flaw lies in process_db_args in ldap_principal2.c, where the DB argument is mishandled, enabling remote authenticated users to trigger a NULL pointer dereference and kadmind crash via a crafted modify_principal request. Affe...

CVE-2013-1416

CVE-2013-1416 affects MIT Kerberos 5 (krb5) KDC prior to 1.10.5. The prep_reprocess_req function in do_tgs_req.c does not correctly perform service-principal realm referral, enabling a remote authenticated user to trigger a denial of service via a crafted TGS-REQ, causing a NULL pointer dereferen...

CVE-2017-15088

CVE-2017-15088 affects MIT Kerberos 5 (krb5) up to version 1.15.2, where the code path plugins/preauth/pkinit/pkinit_crypto_openssl.c mishandles DN fields. The issue can allow a remote attacker to trigger arbitrary code execution or cause a denial of service (buffer overflow/app crash) in scenari...

CVE-2023-39975

CVE-2023-39975 affects MIT Kerberos 5 (krb5) 1.21 and earlier up to 1.21.1. The issue is a double free in KDC TGS processing (kdc/do_tgs_req.c) that is reachable when an authenticated user triggers an authorization-data handling failure, causing improper data copying between tickets and resulting...

CVE-2011-1527

CVE-2011-1527 affects MIT Kerberos 5 (krb5) 1.9–1.9.1 when the LDAP back end is used. The kdb_ldap plugin can be exploited by a kinit operation with incorrect string case for the realm to trigger a NULL pointer dereference and KDC daemon crash (denial of service), involving functions is_principal...

CVE-2014-4342

CVE-2014-4342 affects MIT Kerberos 5 (krb5) 1.7.x through 1.12.x before 1.12.2. The vulnerability arises in GSSAPI session handling: remote injection of invalid tokens can trigger a buffer over-read or NULL pointer dereference, causing the targeted application to crash (DoS). Affected records in ...

CVE-2017-11368

MIT Kerberos krb5 (krb5kdc) is affected by CVE-2017-11368: an authenticated attacker can cause a KDC assertion failure (denial of service) by sending invalid S4U2Self or S4U2Proxy requests. The issue is documented across multiple advisories (Arch, CentOS/Red Hat, and ALAS) with remediation involv...

CVE-2015-8631

CVE-2015-8631 affects MIT Kerberos 5 (krb5) kadmind; a memory leak caused by the code path in kadmin/server/server_stubs.c can be triggered by a request with a NULL principal name. The issue, described as a denial of service via memory exhaustion, occurs in krb5 builds prior to 1.13.4 and in 1.14...

CVE-2015-8629

The vulnerability CVE-2015-8629 affects MIT Kerberos 5 (krb5) kadmind: the xdr_nullstring function in kadm_rpc_xdr.c does not reliably verify presence of terminating '\0' in strings, allowing a remote authenticated user to trigger an out-of-bounds read that can disclose sensitive information or c...

CVE-2007-3999

CVE-2007-3999 is a stack-based buffer overflow in MIT Kerberos 5 (krb5) lib/rpc/svc_auth_gss.c (svcauth_gss_validate) used by rpcsec_gss in krb5 1.4–1.6.2, including kadmind. A long RPC message string can crash the daemon and may enable remote code execution. Affected products include krb5 deploy...

CVE-2014-4344

The MIT Kerberos SPNEGO acceptor (lib/gssapi/spnego/spnego_mech.c, krb5 1.5.x–1.12.x before 1.12.2) is affected by CVE-2014-4344 due to a NULL pointer dereference when processing an empty continuation token during SPNEGO negotiation, enabling remote, unauthenticated denial of service (server cras...

CVE-2005-1174

CVE-2005-1174 affects MIT Kerberos 5 (krb5) KDC; a remote attacker can crash the KDC by sending a certain TCP connection that frees memory twice (heap corruption). The related issues include CVE-2005-1175 (potential remote code execution via a rare TCP request triggering a buffer overflow) and CV...

CVE-2004-0644

The CVE-2004-0644 entry concerns MIT Kerberos 5 (krb5) 1.2.2–1.3.4, where the asn1buf_skiptail function in the ASN.1 decoder library allows remote attackers to cause a denial of service (infinite loop) via a specific BER encoding. Affected software includes the KDC and krb5 libraries; the impact ...

CVE-2015-2694

MIT Kerberos 5 (krb5) 1.12.x and 1.13.x prior to 1.13.2 are vulnerable due to the kdcpreauth modules (OTP and PKINIT) not tracking client validation, enabling a remote attacker to bypass requires_preauth by submitting zero bytes or an arbitrary realm name. This can lead to obtaining a ciphertext ...

CVE-2014-5355

Summary: CVE-2014-5355 affects MIT Kerberos 5 (krb5) where krb5_read_message() mis-handles input, causing a NULL pointer dereference with a zero-byte version string and an out-of-bounds read when the string is not null-terminated. Connected advisories indicate this was fixed in upstream krb5 (e.g...

CVE-2017-7562

CVE-2017-7562 affects MIT krb5 prior to version 1.16.1, where the certauth interface improperly validated client certificates. A remote attacker able to reach the KDC could potentially impersonate arbitrary principals under rare, erroneous circumstances. Root cause: incorrect validation of forged...

CVE-2014-4341

MIT Kerberos 5 (krb5) CVE-2014-4341 is a remote DoS in which an attacker can cause a buffer over-read and crash a GSSAPI session by injecting invalid tokens. Public sources tie this to krb5 releases prior to 1.12.2 (upstream flag) and show impact on servers/applications using GSSAPI SPNEGO. The F...

CVE-2022-39028

CVE-2022-39028 affects telnetd in GNU Inetutils up to 2.3 and MIT krb5-appl up to 1.0.3 (and derivatives). The issue is a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8, causing telnetd to crash; in typical installs the service stays up via inetd, but repeated crashes can render the telnet s...

CVE-2009-0846

The CVE-2009-0846 issue is in MIT Kerberos 5 (krb5) before 1.6.4. The ASN.1 GeneralizedTime decoder’s asn1_decode_generaltime function triggers a free of an uninitialized pointer when processing invalid DER encoding, enabling a remote attacker to cause a denial of service (daemon crash) or possib...

CVE-2011-0283

CVE-2011-0283 | In MIT Kerberos 5 (krb5) 1.9, the Key Distribution Center (KDC) is vulnerable to a remote denial of service via a malformed request packet that does not trigger a response packet, causing a NULL pointer dereference and daemon crash. The description explicitly ties this to the krb5...

CVE-2010-1323

CVE-2010-1323 concerns MIT Kerberos 5 (krb5) with vulnerable checksums in versions 1.3.x–1.8.3. The issue may allow remote attackers to modify user-visible prompt text, alter KDC responses, or forge a KRB-SAFE message when checksums are unkeyed or RC4-based. Connected documents indicate affected ...

CVE-2015-2697

CVE-2015-2697 affects MIT Kerberos 5 (krb5) prior to 1.14. The issue is triggered via a remote authenticated TGS request where the realm field starts with a null byte, enabling an out-of-bounds condition that can crash the KDC (denial of service). The connected document confirms the vulnerability...

CVE-2017-11462

CVE-2017-11462 is a reported double free vulnerability in MIT Kerberos 5 (krb5) with unspecified impact. The initial description states a double free allows attackers to cause unspecified effects via automatic deletion of security contexts on error. Connected documents reiterate the issue as a do...

CVE-2006-3084

CVE-2006-3084 affects MIT Kerberos 5 (krb5) up to 1.5 and 1.4.x before 1.4.4, and Heimdal 0.7.2 and earlier. The issue is that the (1) ftpd and (2) ksu setuid calls do not check return codes, which could allow local privilege escalation if setuid fails to drop privileges. The description notes th...

CVE-2007-2442

CVE-2007-2442 affects MIT Kerberos 5 (krb5) RPC library. In krb5 1.6.1 and earlier, the function gssrpc__svcauth_gssapi can mishandle a zero-length RPC credential, causing kadmind to free an uninitialized pointer during cleanup. This remote flaw could enable arbitrary code execution on vulnerable...

CVE-2016-3120

The vulnerability CVE-2016-3120 affects MIT Kerberos 5 KDC (krb5) where the validate_as_request function in kdc_util.c uses an incorrect client data structure when restrict_anonymous_to_tgt is enabled. This can let remote authenticated users trigger a NULL pointer dereference and crash the krb5 K...

CVE-2009-0844

The CVE entry CVE-2009-0844 (and related CVEs 2009-0845, 2009-0846, 2009-0847) concerns MIT Kerberos 5 (krb5) SPNEGO. The get_input_token function in the SPNEGO implementation (krb5 1.5–1.6.3) allows remote attackers to trigger a buffer over-read via a crafted length value, enabling denial of ser...

CVE-2003-0028

Technical details about CVE-2003-0028 are not present in the provided documents. The connected sources reference the CVE in Debian/OpenVAS advisories but do not specify affected products, root cause, versions, impact, or fixes.

CVE-2014-5352

Summary: CVE-2014-5352 affects MIT Kerberos libgssapi_krb5 (krb5) where gss_process_context_token can mishandle security-context handles, enabling remote authenticated users to cause denial of service (use-after-free/double-free) or potentially execute code via crafted GSSAPI traffic (demonstrate...

CVE-2014-9421

CVE-2014-9421 affects MIT Kerberos krb5 (lib/rpc/auth_gssapi_misc.c) where partial XDR deserialization can lead to a denial of service (use-after-free and double free) and possibly arbitrary code execution by remote authenticated users through malformed XDR data, demonstrated via kadmind traffic....

CVE-2014-5353

The CVE-2014-5353 issue affects MIT Kerberos krb5 when the KDC uses LDAP. A remote authenticated user can crash the KDC/daemon by issuing an LDAP query with no results using an incorrect password policy object type. Root cause: LDAP KDB back end handling of password policy objects (in ldap_pwd_po...

CVE-2014-4345

MIT Kerberos 5 (krb5) kadmind LDAP KDB back end is affected by CVE-2014-4345 due to an off-by-one error in ldap_principal2.c (krb5_encode_krbsecretkey). The flaw can be triggered by a sequence of cpw -keepold commands, allowing remote authenticated users to cause a denial of service via a buffer ...

CVE-2014-4343

CVE-2014-4343 is a double-free flaw in MIT Kerberos SPNEGO: the SPNEGO initiator’s init_ctx_reselect can be corrupted by crafted traffic from an impersonating acceptor, leading to memory corruption or denial of service and potentially code execution. Affected: MIT Kerberos 5 (krb5) 1.10.x through...