CVE-2009-4212
Fixed in a distro release EPSS 8%
Multiple integer underflows in the (1) AES and (2) RC4 decryption functionality in the crypto library in MIT Kerberos 5 (aka krb5) 1.3 through 1.6.3, and 1.7 before 1.7.1, allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by providing ciphertext with a length that is too short to be valid.
Products: mit kerberos, mit kerberos_5
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | krb5 | 1.8+dfsg~alpha1-1 |
| Debian 13 | krb5 | 1.8+dfsg~alpha1-1 |
| Debian 14 | krb5 | 1.8+dfsg~alpha1-1 |
| Debian 4.0 | krb5 | 1.4.4-7etch8 |
| Debian 5.0 | krb5 | 1.6.dfsg.4~beta1-5lenny2 |
| Red Hat Enterprise Linux 3 | krb5 | 0:1.2.7-71 |
| Red Hat Enterprise Linux 3 | krb5-debuginfo | 0:1.2.7-71 |
| Red Hat Enterprise Linux 3 | krb5-devel | 0:1.2.7-71 |
| Red Hat Enterprise Linux 3 | krb5-libs | 0:1.2.7-71 |
| Red Hat Enterprise Linux 3 | krb5-server | 0:1.2.7-71 |
| Red Hat Enterprise Linux 3 | krb5-workstation | 0:1.2.7-71 |
| Red Hat Enterprise Linux 4 | krb5 | 0:1.3.4-62.el4_8.1 |
| Red Hat Enterprise Linux 4 | krb5-debuginfo | 0:1.3.4-62.el4_8.1 |
| Red Hat Enterprise Linux 4 | krb5-devel | 0:1.3.4-62.el4_8.1 |
| Red Hat Enterprise Linux 4 | krb5-libs | 0:1.3.4-62.el4_8.1 |
| Red Hat Enterprise Linux 4 | krb5-server | 0:1.3.4-62.el4_8.1 |
| Red Hat Enterprise Linux 4 | krb5-workstation | 0:1.3.4-62.el4_8.1 |
| Red Hat Enterprise Linux 5 | krb5 | 0:1.6.1-36.el5_4.1 |
| Red Hat Enterprise Linux 5 | krb5-debuginfo | 0:1.6.1-36.el5_4.1 |
| Red Hat Enterprise Linux 5 | krb5-devel | 0:1.6.1-36.el5_4.1 |
| Red Hat Enterprise Linux 5 | krb5-libs | 0:1.6.1-36.el5_4.1 |
| Red Hat Enterprise Linux 5 | krb5-server | 0:1.6.1-36.el5_4.1 |
| Red Hat Enterprise Linux 5 | krb5-workstation | 0:1.6.1-36.el5_4.1 |
| Red Hat rhel eus 4.7 | krb5 | 0:1.3.4-60.el4_7.3 |
| Red Hat rhel eus 4.7 | krb5-debuginfo | 0:1.3.4-60.el4_7.3 |
| Red Hat rhel eus 4.7 | krb5-devel | 0:1.3.4-60.el4_7.3 |
| Red Hat rhel eus 4.7 | krb5-libs | 0:1.3.4-60.el4_7.3 |
| Red Hat rhel eus 4.7 | krb5-server | 0:1.3.4-60.el4_7.3 |
| Red Hat rhel eus 4.7 | krb5-workstation | 0:1.3.4-60.el4_7.3 |
| Red Hat rhel eus 5.2 | krb5 | 0:1.6.1-25.el5_2.3 |
| Red Hat rhel eus 5.2 | krb5-debuginfo | 0:1.6.1-25.el5_2.3 |
| Red Hat rhel eus 5.2 | krb5-devel | 0:1.6.1-25.el5_2.3 |
| Red Hat rhel eus 5.2 | krb5-libs | 0:1.6.1-25.el5_2.3 |
| Red Hat rhel eus 5.2 | krb5-server | 0:1.6.1-25.el5_2.3 |
| Red Hat rhel eus 5.2 | krb5-workstation | 0:1.6.1-25.el5_2.3 |
| Red Hat rhel eus 5.3 | krb5 | 0:1.6.1-31.el5_3.4 |
| Red Hat rhel eus 5.3 | krb5-debuginfo | 0:1.6.1-31.el5_3.4 |
| Red Hat rhel eus 5.3 | krb5-devel | 0:1.6.1-31.el5_3.4 |
| Red Hat rhel eus 5.3 | krb5-libs | 0:1.6.1-31.el5_3.4 |
| Red Hat rhel eus 5.3 | krb5-server | 0:1.6.1-31.el5_3.4 |
| Red Hat rhel eus 5.3 | krb5-workstation | 0:1.6.1-31.el5_3.4 |
| openSUSE Tumbleweed | krb5 | 1.15-1.1 |