Product:

Kerberos

(Mit)
Repositories https://github.com/krb5/krb5
#Vulnerabilities 33
Date Id Summary Products Score Patch Annotated
2018-12-26 CVE-2018-20217 A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request. Debian_linux, Kerberos 5.3
1996-02-21 CVE-1999-0143 Kerberos 4 key servers allow a user to masquerade as another by breaking and generating session keys. Kerberos, Kerberos_5, Multinet, Sunos N/A
2001-08-14 CVE-2001-0554 Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. Debian_linux, Freebsd, Aix, Kerberos, Kerberos_5, Netbsd, Linux_netkit, Openbsd, Irix, Solaris, Sunos N/A
2000-06-09 CVE-2000-0548 Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the e_msg variable in the kerb_err_reply function. Cygnus_network_security, Kerbnet, Kerberos, Kerberos_5 N/A
2000-06-09 CVE-2000-0547 Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the localrealm variable in the process_v4 function. Cygnus_network_security, Kerbnet, Kerberos, Kerberos_5 N/A
2000-06-09 CVE-2000-0546 Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the lastrealm variable in the set_tgtkey function. Cygnus_network_security, Kerbnet, Kerberos, Kerberos_5 N/A
2014-12-16 CVE-2014-5354 plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. Kerberos, Kerberos_5 N/A
2014-07-20 CVE-2014-4342 MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session. Debian_linux, Kerberos, Kerberos_5, Enterprise_linux_desktop, Enterprise_linux_hpc_node, Enterprise_linux_server, Enterprise_linux_workstation N/A
2013-11-18 CVE-2013-6800 An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request, a different vulnerability than CVE-2013-1418. Kerberos, Kerberos_5 N/A
2011-02-10 CVE-2011-0282 The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read, and daemon crash) via a crafted principal name. Kerberos, Kerberos_5 N/A