PT-1996-1050 · Mit · Kerberos 4

Published 1996-11-22 · Updated 2017-10-10 · CVE-1999-1099

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kerberos 4

Description The issue allows remote attackers to obtain sensitive information via a malformed UDP packet. This packet generates an error string that inadvertently includes the realm name and the last user.

Recommendations For Kerberos 4, consider implementing packet validation to prevent the generation of error strings that include sensitive information. As a temporary workaround, restrict access to the Kerberos 4 service to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-1999-1099

Affected Products

Kerberos 4

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-1999-1099 · Security Note
• http://marc.info/?l=bugtraq&m=87602167420184&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65 · Note