CVE-2016-3120: Null Pointer Dereference
The validateasrequest function in kdcutil.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrictanonymoustotgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3120?
CVE-2016-3120 has a medium severity rating as it allows denial of service attacks against the Key Distribution Center.
How do I fix CVE-2016-3120?
To fix CVE-2016-3120, upgrade to MIT Kerberos version 1.13.6 or later, or 1.14.3 or later.
Which versions of MIT Kerberos are affected by CVE-2016-3120?
MIT Kerberos versions 1.13.0 to 1.13.5 and 1.14.0 to 1.14.2 are affected by CVE-2016-3120.
What is the impact of CVE-2016-3120?
CVE-2016-3120 can lead to a denial of service by allowing remote authenticated users to cause service disruptions.
Is CVE-2016-3120 exploitable in all configurations of MIT Kerberos?
CVE-2016-3120 is exploitable only when the restrict_anonymous_to_tgt option is enabled in the configuration.