CVE-2003-0072 — Kerberos vulnerability

7 documents7 sources

Severity

5.0MEDIUMNVD

EPSS

1.3%

top 20.63%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

MIT Krb5 MIT Kerberos MIT Kerberos 5

Timeline

PublishedApr 2

Latest updateApr 29

Description

The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (aka "array overrun").

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶Debianmit/krb5< 1.2.7-3+3

▶NVDmit/kerberos1.0, 1.2.2.beta1+1

▶NVDmit/kerberos_512 versions+11

Patches

Patch: web.mit.edu ↗Patch: www.debian.org ↗Patch: web.mit.edu ↗

🔴Vulnerability Details

GHSA

GHSA-49gw-mv8v-c8mp: The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1↗2022-04-29

▶

OSV

CVE-2003-0072: The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1↗2003-04-02

▶

CVEList

CVE-2003-0072: The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1↗2003-03-26

▶

📋Vendor Advisories

Red Hat

security flaw↗2003-03-19

▶

Debian

CVE-2003-0072: krb5 - The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier allows ...↗2003

▶

💬Community

Bugzilla

CVE-2003-0072 security flaw↗2018-08-16

▶