MIT Kerberos 5 KDC 'do _ tgs_req.c 'Remote Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
MIT Kerberos 5 1.11
Description:
--------------------------------------------------------------------------------
Bugtraq id: 63832
CVE (CAN) ID: CVE-2013-1417

Kerberos is a widely used super-powerful encryption to verify the network protocol between the client and the server.

In KDC versions earlier than Kerberos 5 1.11.4, do_tgs_req.c has a remote denial of service vulnerability caused by NULL pointer reference when using a single-component domain name, attackers exploit this vulnerability in TGS-REQ requests to trigger cross-origin reference host service policies, causing the affected KDC service to crash, resulting in DOS.

<* Source: Sol Jerom
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

MIT
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc
Http://web.mit.edu/kerberos/www/advisories/index.html