|Description||In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|heimdal (PTS)||stretch (security), stretch||7.1.0+dfsg-13+deb9u3||fixed|
|bookworm, sid, bullseye||7.7.0+dfsg-2||fixed|
The information below is based on the following data on fixed versions.
[jessie] - heimdal <not-affected> (Vulnerability introduced in 7.0)
[wheezy] - heimdal <not-affected> (Vulnerability introduced in 7.0)
Fixed by: https://github.com/heimdal/heimdal/commit/749d377fa357351a7bbba51f8aae72cdf0629592 (7.1)
Fixed by: https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887 (master)