MIT Kerberos 5 KDC 'do_tgs_req.c' Remote Denial of Service Vulnerability

Bugtraq ID:	63832
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2013-1417
Remote:	Yes
Local:	No
Published:	Nov 20 2013 12:00AM
Updated:	Apr 13 2015 09:50PM
Credit:	Sol Jerom
Vulnerable:	Xerox FreeFlow Print Server (FFPS) 93.E0.21C Xerox FreeFlow Print Server (FFPS) 90.D3.06 Xerox FreeFlow Print Server (FFPS) 82.D2.24 Xerox FreeFlow Print Server (FFPS) 82.D1.44 Xerox FreeFlow Print Server (FFPS) 82.C5.24 Xerox FreeFlow Print Server (FFPS) 81.D0.73 Xerox FreeFlow Print Server (FFPS) 81.C3.31 Xerox FreeFlow Print Server (FFPS) 73.D4.31B Xerox FreeFlow Print Server (FFPS) 73.D4.31 Xerox FreeFlow Print Server (FFPS) 73.D2.33 MIT Kerberos 5 1.11.1 MIT Kerberos 5 1.11.3 MIT Kerberos 5 1.11.2 Gentoo Linux
Not Vulnerable:	MIT Kerberos 5 1.11.4

MIT Kerberos 5 KDC 'do_tgs_req.c' Remote Denial of Service Vulnerability

MIT Kerberos 5 is prone to a remote denial-of-service vulnerability due to a NULL pointer dereference error in the Key Distribution Center(KDC).

Attackers can exploit this issue to crash the affected KDC service, resulting in denial-of-service conditions.

Kerberos 5 versions 1.11.x prior to 1.11.4 are vulnerable.

MIT Kerberos 5 KDC 'do_tgs_req.c' Remote Denial of Service Vulnerability

An attacker can exploit this issue using readily available tools.

MIT Kerberos 5 KDC 'do_tgs_req.c' Remote Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

MIT Kerberos 5 KDC 'do_tgs_req.c' Remote Denial of Service Vulnerability

References:

• Bug 1030743 - (CVE-2013-1417) CVE-2013-1417 krb5: KDC null deref due to referral (Red Hat Bugzilla)
  
• KDC null deref due to referrals [CVE-2013-1417] (tlyu)
  
• Kerberos Homepage (MIT)
  
• Xerox Security Bulletin XRX14-004 (Xerox)