Medium severity6.5NVD Advisory· Published Aug 1, 2016· Updated May 6, 2026
CVE-2016-3120
CVE-2016-3120
Description
The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
10- krbdev.mit.edu/rt/Ticket/Display.htmlnvdIssue Tracking
- lists.opensuse.org/opensuse-updates/2016-09/msg00035.htmlnvd
- rhn.redhat.com/errata/RHSA-2016-2591.htmlnvd
- web.mit.edu/kerberos/krb5-1.13/nvd
- web.mit.edu/kerberos/krb5-1.14/nvd
- www.securityfocus.com/bid/92132nvd
- www.securitytracker.com/id/1036442nvd
- github.com/krb5/krb5/commit/93b4a6306a0026cf1cc31ac4bd8a49ba5d034ba7nvd
- lists.debian.org/debian-lts-announce/2018/01/msg00040.htmlnvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AWL3KYFRJIX37EAM4DKCQQIQP2WBKL35/nvd
News mentions
0No linked articles in our index yet.