The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-pkinit-opensslUpgrade krb5-develUpgrade krb5-libsUpgrade krb5-server-ldap | Dec 1, 2016 | Mar 4, 2013 |
| Debian | — | Upgrade krb5 | Jul 30, 2024 | Mar 5, 2013 |
| Oracle Solaris | — | Upgrade consolidation/osnet/osnet-incorporation to version 0.5.11-0.175.2.0.0.42.2 on Solaris 11.2Upgrade service/security/kerberos-5 to version 0.5.11-0.175.1.10.0.3.2 on Solaris 11.1 | May 29, 2017 | Mar 4, 2013 |
| Oracle_linux | — | Upgrade krb5-pkinit-opensslUpgrade krb5-libsUpgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-develUpgrade krb5-server | Oct 16, 2024 | Mar 3, 2013 |
| Suse | — | Upgrade krb5-plugin-preauth-pkinitUpgrade krb5-plugin-kdb-ldapUpgrade krb5-develUpgrade krb5-serverUpgrade krb5-plugin-preauth-otpUpgrade krb5-32bitUpgrade krb5-plugin-preauth-spakeUpgrade krb5-docUpgrade krb5Upgrade krb5-client | Dec 12, 2013 | Jun 28, 2013 |
| Ubuntu | — | Upgrade krb5-kdc-ldapUpgrade libkrb5support0Upgrade libkdb5-4Upgrade libkadm5clnt-mit7Upgrade libkdb5-6Upgrade libgssrpc4Upgrade libkadm5clnt-mit8Upgrade krb5-admin-serverUpgrade libk5crypto3Upgrade krb5-otpUpgrade krb5-pkinitUpgrade libgssapi-krb5-2Upgrade krb5-userUpgrade libkadm5srv-mit9Upgrade libkadm5srv-mit7Upgrade libkadm5srv-mit8Upgrade libkadm5clnt-mit9Upgrade libkdb5-7Upgrade libkrad0Upgrade krb5-kdcUpgrade libkrb5-3 | Nov 8, 2024 | Mar 5, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub