CVE-2016-3120 Null dereference in n/a

Medium 6.5 Published 1 Aug 2016 Updated 5 Aug 2024

Remote authenticated users can crash the Kerberos KDC via a null pointer dereference when restrict_anonymous_to_tgt is enabled.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-3120?

CVE-2016-3120 is a medium-severity vulnerability in Mit Kerberos 5, published on 1 Aug 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

Weakness: CWE-476

Which versions are affected by CVE-2016-3120?

It affects 1 product.

Linux distribution packages (4)

`krb5` SUSE:Linux Enterprise Desktop 12 SP1	All versions	`1.12.1-36.4`
`krb5` SUSE:Linux Enterprise Server 12 SP1	All versions	`1.12.1-36.4`
`krb5` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	All versions	`1.12.1-36.4`
`krb5` SUSE:Linux Enterprise Software Development Kit 12 SP1	All versions	`1.12.1-36.4`

Products include Mit Kerberos 5.

How do I fix CVE-2016-3120?

Upgrade to a fixed version.

Is CVE-2016-3120 being exploited?

There is no known exploitation of CVE-2016-3120 in the wild and no public exploit code.

All Mit Kerberos 5 vulnerabilities

Sources

Also known as ALPINE-CVE-2016-3120, DEBIAN-CVE-2016-3120, GHSA-8q8p-vxj6-fg2g, MGASA-2016-0306, SUSE-SU-2016:2136-1, UBUNTU-CVE-2016-3120.