CVE-2000-0389: Buffer Overflow
Buffer overflow in krbrdreq function in Kerberos 4 and 5 allows remote attackers to gain root privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Kerberos 4from your environment.If Kerberos 4 is not required, uninstall / remove the Kerberos 4 server and associated daemons to eliminate exposure to the vulnerable krb_rd_req function.
- Remove
Remove
Kerberos 5from your environment.If Kerberos 5 is not required, uninstall / remove the Kerberos 5 server and associated daemons to eliminate exposure to the vulnerable krb_rd_req function.
- Configuration
Stop and disable the Kerberos authentication service(s) (the daemon handling krb_rd_req) until a vendor/maintainer patch is available and applied.
Kerberos (krb_rd_req service/daemon) service_enabled = false - Compensating control
Restrict network access to Kerberos service ports (e.g., via firewall, ACLs or network segmentation) so only trusted hosts and networks can reach the service until a fix is applied.
- Operational
If compromise is suspected or to be cautious, rotate/revoke any potentially exposed credentials (including privileged/root credentials), audit logs for suspicious authentication or root-level activity, and rebuild compromised hosts before returning them to production.
Event History
Frequently Asked Questions
What is the severity of CVE-2000-0389?
CVE-2000-0389 has a high severity rating due to the potential for remote attackers to gain root privileges through a buffer overflow.
How do I fix CVE-2000-0389?
To fix CVE-2000-0389, update the affected versions of Kerberos to the latest patches provided by the vendor.
What software is affected by CVE-2000-0389?
CVE-2000-0389 affects Kerberos 4 and 5, particularly versions from Cygnus and MIT, as well as Red Hat Linux 6.2.
Can I exploit CVE-2000-0389?
Exploiting CVE-2000-0389 requires access to the vulnerable services running Kerberos, which can lead to elevated privileges for attackers.
What are the symptoms of CVE-2000-0389 being exploited?
Symptoms of exploitation for CVE-2000-0389 may include unexpected crashes, unauthorized access to services, or unusual user activity.