CVE-2003-0138: High severity mit kerberos vulnerability
Version 4 of the Kerberos protocol (krb4), as used in Heimdal and other packages, allows an attacker to impersonate any principal in a realm via a chosen-plaintext attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Disable or remove support for Kerberos protocol version 4 (krb4) in Heimdal and other Kerberos implementations. If immediate removal is not possible, configure servers and clients to refuse or reject krb4 tickets and isolate any systems that still require krb4 until they can be remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0138?
CVE-2003-0138 is considered a high-severity vulnerability due to the potential for an attacker to impersonate any principal.
How do I fix CVE-2003-0138?
To fix CVE-2003-0138, upgrade to a version of Kerberos that does not include the vulnerable krb4 implementation.
What systems are affected by CVE-2003-0138?
CVE-2003-0138 affects systems using Version 4 of the Kerberos protocol, specifically implementations that utilize krb4.
What exploitation methods apply to CVE-2003-0138?
CVE-2003-0138 can be exploited through a chosen-plaintext attack, allowing an attacker to impersonate any principal in the realm.
Is CVE-2003-0138 still a concern for modern systems?
While CVE-2003-0138 primarily affects older versions of Kerberos, any legacy systems still using krb4 may still be vulnerable.