FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

krb5 -- KDC null pointer dereference in TGS handling

Affected packages
1.9	<=	krb5	<	1.9.2_1

Details

VuXML ID	6c7d9a35-2608-11e1-89b4-001ec9578670
Discovery	2011-12-11
Entry	2011-12-14

The MIT Kerberos Team reports:

In releases krb5-1.9 and later, the KDC can crash due to a NULL pointer dereference in code that handles TGS (Ticket Granting Service) requests. The trigger condition is trivial to produce using unmodified client software, but requires the ability to authenticate as a principal in the KDC's realm.

[source]

References

CVE Name	CVE-2011-1530
URL	http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2011-007.txt