NetSight
IP …
medium5.0

CVE-2002-2443

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which all…

Impact

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.

Affected products

VendorProductAffected versions
MitKerberos 5
before 1.11.3
OpensuseOpensuse
Versions 11.4, 12.2, 12.3
FedoraprojectFedora
Versions 17, 18, 19
RedhatEnterprise Linux Desktop
Versions 5.0, 6.0
RedhatEnterprise Linux Eus
Versions 5.9, 6.4
RedhatEnterprise Linux Server
Versions 5.0, 6.0
RedhatEnterprise Linux Server Aus
Version 6.4
RedhatEnterprise Linux Workstation
Versions 5.0, 6.0
DebianDebian Linux
Versions 6.0, 7.0, 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 15.04, 15.10

Weakness classification

CWE-20

References