CVE-2009-3295 — Kerberos 5 vulnerability

8 documents8 sources
Severity
5.0MEDIUMNVD
EPSS
2.7%
top 14.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MIT Krb5MIT Kerberos 5
Timeline
PublishedDec 29
Latest updateMay 2

Description

The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages2 packages

▶Debianmit/krb5< 1.7+dfsg-4+3

Patches

Patch: web.mit.edu ↗Patch: www.securityfocus.com ↗Patch: www.vupen.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-m68p-v7vm-cp2m: The prep_reprocess_req function in kdc/do_tgs_req↗2022-05-02
▶
CVEList
CVE-2009-3295: The prep_reprocess_req function in kdc/do_tgs_req↗2009-12-29
▶
OSV
CVE-2009-3295: The prep_reprocess_req function in kdc/do_tgs_req↗2009-12-29
▶

📋Vendor Advisories

3
Ubuntu
Kerberos vulnerability↗2010-01-06
▶
Red Hat
krb5: KDC denial of service in cross-realm referral processing (MITKRB5-SA-2009-003)↗2009-12-28
▶
Debian
CVE-2009-3295: krb5 - The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral ...↗2009
▶

💬Community

1
Bugzilla
CVE-2009-3295 krb5: KDC denial of service in cross-realm referral processing (MITKRB5-SA-2009-003)↗2009-12-07
▶
CVE-2009-3295 — MIT Kerberos 5 vulnerability | cvebase