Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Kerberos Authentication on Linux and AIX Can Be Hijacked

CVE-2025-3576 · published 1 year ago
Summary

A weakness in the way Kerberos handles passwords on Linux and AIX systems can allow an attacker to pretend to be a trusted user. This means that sensitive information could be stolen or modified. To protect yourself, update your Kerberos implementation to use stronger encryption and disable RC4-HMAC-MD5 if possible.

What to do
  • Update debian krb5 to version 1.18.3-6+deb11u7.
  • Update debian krb5 to version 1.20.1-2+deb12u4.
  • Update debian krb5 to version 1.21.2-1.
  • Update debian rootio-krb5 to version 1.20.1-2+deb12u3.root.io.3.
Affected software
Ecosystem VendorProductAffected versions
– red hat red hat enterprise linux 10 All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 8.2 advanced update support All versions
– red hat red hat enterprise linux 8.4 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.4 extended update support long-life add-on All versions
– red hat red hat enterprise linux 8.6 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.6 telecommunications update service All versions
– red hat red hat enterprise linux 8.6 update services for sap solutions All versions
– red hat red hat enterprise linux 8.8 telecommunications update service All versions
– red hat red hat enterprise linux 8.8 update services for sap solutions All versions
– red hat red hat enterprise linux 9 All versions
– red hat red hat enterprise linux 9.0 update services for sap solutions All versions
– red hat red hat enterprise linux 9.2 update services for sap solutions All versions
– red hat red hat enterprise linux 9.4 extended update support All versions
– red hat red hat discovery 2 All versions
– red hat red hat enterprise linux 6 All versions
– red hat red hat enterprise linux 7 All versions
– red hat red hat openshift container platform 4 All versions
Debian:11 debian krb5 < 1.18.3-6+deb11u7
Fix: upgrade to 1.18.3-6+deb11u7
Debian:12 debian krb5 < 1.20.1-2+deb12u4
Fix: upgrade to 1.20.1-2+deb12u4
Debian:13 debian krb5 < 1.21.2-1
Fix: upgrade to 1.21.2-1
Debian:14 debian krb5 < 1.21.2-1
Fix: upgrade to 1.21.2-1
Root:Debian:12 debian rootio-krb5 < 1.20.1-2+deb12u3.root.io.3
Fix: upgrade to 1.20.1-2+deb12u3.root.io.3
Original advisory text
Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-328Use of Weak Hash
Timeline
Published15 Apr 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-3576 · NVD
CVE-2025-3576 · MITRE
ROOT-OS-DEBIAN-12-CVE-2025-3576 · OSV
DEBIAN-CVE-2025-3576 · OSV
Track software like this
Free during beta