1. Ubuntu Security Notices
  2. USN-999-1

USN-999-1: Kerberos vulnerability

Publication date

5 October 2010

Overview

Remote authenticated users could crash the KDC.

Releases

Packages

  • krb5 - MIT Kerberos

Details

Mike Roszkowski discovered that the Kerberos KDC did not correctly
validate the contents of certain messages. If an authenticated remote
attacker sent specially crafted TGS requests, the KDC service would crash,
leading to a denial of service.

Mike Roszkowski discovered that the Kerberos KDC did not correctly
validate the contents of certain messages. If an authenticated remote
attacker sent specially crafted TGS requests, the KDC service would crash,
leading to a denial of service.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
10.10 maverick krb5-kdc –  1.8.1+dfsg-5ubuntu0.1
10.04 lucid krb5-kdc –  1.8.1+dfsg-2ubuntu0.3

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›