Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2004-0371: Heimdal lets controlled realm impersonate users
CVE-2004-0371 · published 22 years ago
Summary
Versions of Heimdal before 0.6.1 and 0.5.3 do not correctly verify cross-realm authentication requests. An attacker who controls one trusted domain can pretend to be other users when moving between domains. Upgrade Heimdal to the latest version or apply the vendor's security patch.
What to do
- Update debian heimdal to version 0.6.1-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | heimdal |
< 0.6.1-1 Fix: upgrade to 0.6.1-1
|
| Debian:13 | debian | heimdal |
< 0.6.1-1 Fix: upgrade to 0.6.1-1
|
| Debian:14 | debian | heimdal |
< 0.6.1-1 Fix: upgrade to 0.6.1-1
|
| – | kth | heimdal |
0.4a 0.4b 0.4c 0.4d 0.4e 0.5 0.5.1 0.5.2 0.6.0 cpe:2.3:a:kth:heimdal:0.4a:*:*:*:*:*:*:* |
Original advisory text
Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate...
Heimdal 0.6.x before 0.6.1 and 0.5.x before 0.5.3 does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path.
References
- https://security-tracker.debian.org/tracker/CVE-2004-0371 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200404-09.xml Vendor Advisory
- http://www.debian.org/security/2004/dsa-476 Patch Vendor Advisory
- http://www.pdc.kth.se/heimdal/advisory/2004-04-01/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15701
Severity
5.0
Medium
Timeline
Published4 May 2004
Updated31 Oct 2026
First seen15 Sep 2026
Track software like this
Free during beta