Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Debian krb5 can be crashed by remote attacker

CVE-2009-0845 · published 17 years ago
Summary

Versions 1.5 through 1.6.3 of the Debian krb5 package may stop working if a specially crafted request is received. An attacker can send malformed data that makes the service crash, causing a temporary denial of service. Apply the latest security update or upgrade to a newer version of krb5 to prevent this.

What to do
  • Update debian krb5 to version 1.6.dfsg.4~beta1-13.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian krb5 < 1.6.dfsg.4~beta1-13
Fix: upgrade to 1.6.dfsg.4~beta1-13
Debian:13 debian krb5 < 1.6.dfsg.4~beta1-13
Fix: upgrade to 1.6.dfsg.4~beta1-13
Debian:14 debian krb5 < 1.6.dfsg.4~beta1-13
Fix: upgrade to 1.6.dfsg.4~beta1-13
– mit kerberos 5-1.6.3
cpe:2.3:a:mit:kerberos:5-1.6.3:*:*:*:*:*:*:*
– mit kerberos_5 1.5
1.5.1
1.5.2
1.5.3
1.6
1.6.1
1.6.2
cpe:2.3:a:mit:kerberos_5:1.5:*:*:*:*:*:*:*
Original advisory text
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of servi...
The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3, when SPNEGO is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via invalid ContextFlags data in the reqFlags field in a negTokenInit token.
References
Severity
5.0 Medium
Exploitation
6% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published27 Mar 2009
Updated4 Nov 2026
First seen17 Sep 2026
Sources
DEBIAN-CVE-2009-0845 · OSV
CVE-2009-0845 · NVD
Track software like this
Free during beta