CVE-2009-3295

Published: 29 December 2009

The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.

Priority

Status

Package	Release	Status
krb5 Launchpad, Ubuntu, Debian	dapper	Not vulnerable (code not present)
	hardy	Not vulnerable (code not present)
	intrepid	Not vulnerable (code not present)
	jaunty	Not vulnerable (code not present)
	karmic	Released (1.7dfsg~beta3-1ubuntu0.1)
	upstream	Released (1.7.1)

References

https://ubuntu.com/security/notices/USN-879-1
https://www.cve.org/CVERecord?id=CVE-2009-3295
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.