CVE-2002-2443

MEDIUM 5.0CVE-2002-2443 · Published 29/05/2013 · updated 16/06/2026

In short

CVE-2002-2443 is a MEDIUM (CVSS 5.0) vulnerability affecting kerberos 5 (mit).
Chance of exploitation in the next 30 days (EPSS): 6.2%, higher than 93.5% of all vulnerabilities.
Fix: update to 1.11.3 or later.

Package	Affected versions	Patched versions
kerberos 5 mit	`< 1.11.3`	`1.11.3`

Description

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.

References

krbdev.mit.edu/rt/Ticket/Display.html · Vendor Advisory
lists.fedoraproject.org/pipermail/package-announce/2013-May/105879.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2013-May/105978.html · Third Party Advisory
lists.fedoraproject.org/pipermail/package-announce/2013-May/106698.html · Third Party Advisory
lists.opensuse.org/opensuse-updates/2013-07/msg00004.html · Mailing List
lists.opensuse.org/opensuse-updates/2013-07/msg00007.html · Mailing List
rhn.redhat.com/errata/RHSA-2013-0942.html · Third Party Advisory
debian.org/security/2013/dsa-2701 · Third Party Advisory
mandriva.com/security/advisories · Third Party Advisory
ubuntu.com/usn/USN-2810-1 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi

More vulnerabilities in kerberos 5

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free