Denial of Service in krb5
Summary
DSA-1969-1: krb5 - denial of service. Affects krb5 versions < 1.4.4-7etch8. Fixed in 1.4.4-7etch8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The krb5 package is a system used for authenticating users and services on a network. It provides secure communication and encryption capabilities. The package is widely used in various Debian distributions, including Debian 4.0 (etch) and Debian 5.0 (lenny).
Vulnerability Detail
The krb5 package is vulnerable to an integer underflow in the AES and RC4 decryption operations of the crypto library. This vulnerability can be exploited by a remote attacker to cause crashes, heap corruption, or, under extremely unlikely conditions, arbitrary code execution. The impact of this vulnerability can range from denial of service to potential remote code execution.
How To Fix
Minimum fixed version
1.4.4-7etch8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade krb5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability.
Conclusion
The krb5 package is vulnerable to a denial of service vulnerability due to an integer underflow in the crypto library. It is recommended to upgrade the package to the fixed versions mentioned above. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for krb5 →
FAQ
krb5 is a system for authenticating users and services on a network. It provides secure communication and encryption capabilities.
The vulnerability can lead to denial of service, crashes, heap corruption, or, under extremely unlikely conditions, arbitrary code execution.
To fix this vulnerability, upgrade the krb5 package to the fixed versions: 1.4.4-7etch8 for Debian 4.0 (etch) and 1.6.dfsg.4~beta1-5lenny2 for Debian 5.0 (lenny).
There are no known workarounds for this vulnerability.
You can find more information about this vulnerability in the Debian Security Advisory DSA-1969-1.
Related vulnerabilities
Recent vulnerabilities recorded for krb5.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
