Nalin Dahyabhai

**Name of the Vulnerable Software and Affected Versions** MIT Kerberos 5 versions prior to 1.10.4 **Description** The issue allows remote attackers to cause a denial of service via a crafted Draft 9 request. This is due to the pkinit server return padata function attempting to find an agility KDF identifier in inappropriate circumstances, leading to a NULL pointer dereference and daemon crash. The vulnerability can be exploited by a remote attacker who has passed the authentication procedure, potentially disrupting the confidentiality, integrity, and availability of protected information. **Recommendations** For versions prior to 1.10.4, update to version 1.10.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `pkinit server return padata` function in the plugins/preauth/pkinit/pkinit srv.c file until a patch is available.

**Name of the Vulnerable Software and Affected Versions** MIT Kerberos 5 versions 1.9 through 1.9.1 MIT Kerberos 5 versions prior to 1.9.2 **Description** The issue allows remote attackers to cause a denial of service, potentially leading to a disruption in confidentiality, integrity, and availability of protected information. This can be achieved through a kinit operation with incorrect string case for the realm. The functions `is principal in realm`, `krb5 set error message`, `krb5 ldap get principal`, and `process as req` are related to this issue. **Recommendations** For versions 1.9 through 1.9.1, update to version 1.9.2 or later to resolve the issue. For versions prior to 1.9.2, update to version 1.9.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the kdb ldap plugin in the Key Distribution Center (KDC) until a patch is available.

**Name of the Vulnerable Software and Affected Versions** krb5-workstation versions 1.1.1 through 1.2.7 krb5-devel versions 1.1.1 through 1.2.7 krb5-configs version 1.1.1 krb5-server versions 1.1.1 through 1.2.7 krb5-libs versions 1.1.1 through 1.2.7 krb5 versions 1.1.1 through 1.2.7 **Description** The issue affects the Kerberos 5 (krb5) package in Red Hat Linux, allowing remote exploitation that may lead to a violation of confidentiality, integrity, and availability of protected information. The Key Distribution Center (KDC) in Kerberos 5 (krb5) 1.2.7 and earlier is vulnerable to a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap. **Recommendations** For krb5-workstation versions 1.1.1 through 1.2.7, update to a version later than 1.2.7. For krb5-devel versions 1.1.1 through 1.2.7, update to a version later than 1.2.7. For krb5-configs version 1.1.1, update to a version later than 1.1.1. For krb5-server versions 1.1.1 through 1.2.7, update to a version later than 1.2.7. For krb5-libs versions 1.1.1 through 1.2.7, update to a version later than 1.2.7. For krb5 versions 1.1.1 through 1.2.7, update to a version later than 1.2.7.

**Name of the Vulnerable Software and Affected Versions** krb5 versions 1.1.1 through 1.2.2 krb5-server versions 1.1.1 through 1.2.2 krb5-workstation versions 1.1.1 through 1.2.2 krb5-devel versions 1.1.1 through 1.2.2 krb5-configs version 1.1.1 krb5-libs version 1.1.1 **Description** The issue affects the Kerberos 5 (krb5) package in Red Hat Linux, allowing remote attackers to cause a denial of service or disrupt the confidentiality, integrity, and availability of protected information. The Key Distribution Center (KDC) in Kerberos 5 allows remote, authenticated attackers to cause a denial of service on KDCs within the same realm using a certain protocol request. **Recommendations** For krb5 versions 1.1.1 through 1.2.2, update to a version later than 1.2.2 to resolve the issue. For krb5-server versions 1.1.1 through 1.2.2, update to a version later than 1.2.2 to resolve the issue. For krb5-workstation versions 1.1.1 through 1.2.2, update to a version later than 1.2.2 to resolve the issue. For krb5-devel versions 1.1.1 through 1.2.2, update to a version later than 1.2.2 to resolve the issue. For krb5-configs version 1.1.1, update to a version later than 1.1.1 to resolve the issue. For krb5-libs version 1.1.1, update to a version later than 1.1.1 to resolve the issue.