Vulnerability Details : CVE-2009-3295
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2009-3295
- cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-3295
89.49%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-3295
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST |
Vendor statements for CVE-2009-3295
-
Red Hat 2010-01-11Not vulnerable. This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 3, 4, or 5.
References for CVE-2009-3295
-
http://www.securityfocus.com/archive/1/508622/100/0/threaded
-
http://www.vupen.com/english/advisories/2009/3652
Site en constructionPatch;Vendor Advisory
-
http://www.securityfocus.com/bid/37486
Patch
-
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-003.txt
Patch;Vendor Advisory
-
http://securitytracker.com/id?1023392
Access Denied
Jump to