CVE-2013-1417

Published: Nov 20, 2013Modified: Apr 29, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.

Affected (4)

Products: Mit: Kerberos 5

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	Version 1.11.1
Mit Kerberos 5	Version 1.11.2
Mit Kerberos 5	Version 1.11.3
Mit Kerberos 5	Version 1.11

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (8)

http://lists.opensuse.org/opensuse-updates/2013-12/msg00026.html

Source: cve@mitre.org

http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt

Source: cve@mitre.org

https://bugzilla.redhat.com/show_bug.cgi?id=1030743

Source: cve@mitre.org

https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc

Source: cve@mitre.org

ExploitPatch

http://lists.opensuse.org/opensuse-updates/2013-12/msg00026.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=1030743

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatch

Timeline

No history available yet.