CVE-2002-1235

published 2002-11-04

CVE-2002-1235: The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind…

Priority P2 63 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

ITW VulnCheck KEV

The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	debian_linux	—	—
debian	heimdal	< heimdal 0.4e-22 (bookworm)	heimdal 0.4e-22 (bookworm)
debian	krb5	< heimdal 0.4e-22 (bookworm)	heimdal 0.4e-22 (bookworm)
heimdal_project	heimdal	>= 0 < 0.4e-22	0.4e-22
heimdal_project	heimdal	>= 0 < 0.4e-22	0.4e-22
heimdal_project	heimdal	>= 0 < 0.4e-22	0.4e-22
heimdal_project	heimdal	>= 0 < 0.4e-22	0.4e-22
kth	kth_kerberos_4	< 1.2.1	1.2.1
kth	kth_kerberos_5	< 0.5.1	0.5.1
mit	kerberos_5	1.0 – 1.2.6	—
mit	krb5	>= 0 < 1.2.6-2	1.2.6-2
mit	krb5	>= 0 < 1.2.6-2	1.2.6-2
mit	krb5	>= 0 < 1.2.6-2	1.2.6-2
mit	krb5	>= 0 < 1.2.6-2	1.2.6-2

Detection & IOCs extracted from sources · hover to see the quote

port 749

port 751

bytes

|00 C0 05 08 00 C0 05 08 00 C0 05 08 00 C0 05 08|

bytes

|FF FF|KADM0.0A|00 00 FB 03|

snort

alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|00 C0 05 08 00 C0 05 08 00 C0 05 08 00 C0 05 08|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101894; rev:9; metadata:created_at 2010_09_23, cve CVE_2002_1226, confidence High, signature_severity Major, updated_at 2019_07_26;)

snort

alert tcp $EXTERNAL_NET any -> $HOME_NET 749 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|FF FF|KADM0.0A|00 00 FB 03|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101896; rev:9; metadata:created_at 2010_09_23, cve CVE_2002_1226, confidence High, signature_severity Major, updated_at 2019_07_26;)

snort

alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|FF FF|KADM0.0A|00 00 FB 03|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101897; rev:9; metadata:created_at 2010_09_23, cve CVE_2002_1226, confidence High, signature_severity Major, updated_at 2019_07_26;)

snort

alert tcp $EXTERNAL_NET any -> $HOME_NET 751 (msg:"GPL EXPLOIT kadmind buffer overflow attempt"; flow:established,to_server; content:"|00 C0 05 08 00 C0 05 08 00 C0 05 08 00 C0 05 08|"; reference:bugtraq,5731; reference:bugtraq,6024; reference:cve,2002-1226; reference:cve,2002-1235; reference:url,www.kb.cert.org/vuls/id/875073; classtype:shellcode-detect; sid:2101895; rev:9; metadata:created_at 2010_09_23, cve CVE_2002_1226, confidence High, signature_severity Major, updated_at 2019_07_26;)

• → Exploit traffic targets kadmind on TCP ports 749 and 751; monitor for established inbound connections to these ports from external networks.
• → Two distinct shellcode byte patterns are used in the exploit: a repeated 4-byte sequence (|00 C0 05 08|) and a protocol-header pattern (|FF FF|KADM0.0A|00 00 FB 03|); either pattern in a TCP stream to kadmind ports is a strong indicator of exploitation.
• → The vulnerability is in the kadm_ser_in function which does not properly verify the length field of a request; anomalously large length fields in Kerberos 4 kadmin requests should be flagged. ↗
• → Classtype is shellcode-detect with High confidence and Major severity; treat any match as a high-priority alert requiring immediate investigation.

• · The vulnerability affects kadmind4 (Kerberos v4 compatibility mode) in MIT krb5 ≤ 1.2.6, KTH eBones < 1.2.1, and Heimdal < 0.5.1 only when compiled with Kerberos 4 support; deployments without Kerberos 4 support are not affected. ↗
• · The Snort rules reference both CVE-2002-1226 and CVE-2002-1235; the same byte-pattern signatures cover both CVEs, so a match does not exclusively confirm CVE-2002-1235.

CVSS provenance

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

osv 10.0 CRITICAL

vulncheck 10.0 CRITICAL

vendor_debian 10.0 CRITICAL

vendor_redhat 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-130