CVE-2003-0139: High severity mit kerberos vulnerability
Certain weaknesses in the implementation of version 4 of the Kerberos protocol (krb4) in the krb5 distribution, when triple-DES keys are used to key krb4 services, allow an attacker to create krb4 tickets for unauthorized principals using a cut-and-paste attack and "ticket splicing."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable support for Kerberos version 4 (krb4) in the krb5 distribution to prevent creation/acceptance of krb4 tickets that can be forged via cut-and-paste ticket splicing.
Kerberos (krb5 krb4 implementation) krb4_support = disabled - Configuration
Do not use triple-DES keys to key krb4 services; reconfigure or re-key krb4 services to avoid using triple-DES, since the vulnerability occurs when triple-DES keys are used.
Kerberos (krb5 krb4 implementation) use_triple_DES_for_krb4_services = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0139?
CVE-2003-0139 is considered a medium severity vulnerability due to its potential to allow unauthorized access to services.
How do I fix CVE-2003-0139?
To fix CVE-2003-0139, upgrade to a version of MIT Kerberos that does not utilize version 4 of the Kerberos protocol or implement strong security measures to mitigate ticket splicing.
What systems are affected by CVE-2003-0139?
CVE-2003-0139 affects systems running version 4 of the Kerberos protocol in the MIT Kerberos 5 distribution that use triple-DES keys.
What type of attack does CVE-2003-0139 enable?
CVE-2003-0139 enables attacks such as cut-and-paste attacks and ticket splicing, allowing for unauthorized creation of krb4 tickets.
Is CVE-2003-0139 still a relevant concern today?
While CVE-2003-0139 was reported in 2003, systems still using the vulnerable configuration could still be at risk, making it a relevant concern.