CVE-2025-3576: Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions
First published: Mon Apr 14 2025(Updated: )
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Kerberos |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3576?
CVE-2025-3576 has a severity rating that indicates a significant security risk due to its potential for message spoofing.
How do I fix CVE-2025-3576?
To fix CVE-2025-3576, update your MIT Kerberos implementation to a version that disables or mitigates the use of RC4-HMAC-MD5.
Who is affected by CVE-2025-3576?
CVE-2025-3576 affects users of the MIT Kerberos implementation that allows the use of GSSAPI with RC4-HMAC-MD5.
What attack vectors are associated with CVE-2025-3576?
CVE-2025-3576 can be exploited through MITD messages, where an attacker can use MD5 collisions to spoof integrity protections.
Is there a workaround for CVE-2025-3576?
A temporary workaround for CVE-2025-3576 includes configuring the system to prefer stronger encryption methods over RC4.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/title
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2025-3576
- agent/description
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/last-modified-date
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/mit
- canonical/kerberos