The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
CVSS Details
- CVSS 3.1 Base Score: 6.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade krb5 | Aug 30, 2017 | Nov 8, 2015 |
| Debian | — | Upgrade krb5 | Nov 9, 2015 | Nov 6, 2015 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Oct 30, 2017 | Nov 8, 2015 |
| Oracle Solaris | — | Upgrade system/security/kerberos-5 to version 0.5.11-0.175.3.8.0.4.0 on Solaris 11.3Upgrade service/security/kerberos-5 to version 0.5.11-0.175.3.8.0.2.0 on Solaris 11.3Upgrade system/library/security/gss/spnego to version 0.5.11-0.175.3.8.0.2.0 on Solaris 11.3Upgrade system/kernel/security/gss to version 0.5.11-0.175.3.8.0.2.0 on Solaris 11.3 | May 29, 2017 | Nov 8, 2015 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 25, 2015 |
| Suse | — | Upgrade krb5-plugin-preauth-pkinitUpgrade krb5-serverUpgrade krb5-plugin-kdb-ldapUpgrade krb5-plugin-preauth-otpUpgrade krb5Upgrade krb5-docUpgrade krb5-clientUpgrade krb5-32bitUpgrade krb5-devel | Dec 18, 2015 | Nov 4, 2015 |
| Ubuntu | — | Upgrade krb5-kdc-ldapUpgrade krb5-admin-serverUpgrade libkrb53Upgrade libkadm5clnt-mit8Upgrade krb5-otpUpgrade libgssrpc4Upgrade libkrb5support0Upgrade libkdb5-6Upgrade libkadm5clnt-mit9Upgrade libkdb5-7Upgrade libkrb5-3Upgrade krb5-kdcUpgrade krb5-pkinitUpgrade krb5-userUpgrade krb5-k5tlsUpgrade libkdb5-8Upgrade libgssapi-krb5-2Upgrade libk5crypto3Upgrade libkrad0 | Nov 16, 2015 | Nov 8, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub