CVE-2011-1527 — krb5: KDC denial of service vulnerabilities (MITKRB5-SA-2011-006)

Back Back to CVE browser

HIGH

krb5: KDC denial of service vulnerabilities (MITKRB5-SA-2011-006)

Published Oct 20, 2011

7.8

HIGH

CVSS 2.0

EPSS 3.65%

Description

The kdb_ldap plugin in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions.

Affected products

Red Hat Enterprise Linux 6

krb5-0:1.9-9.el6_1.2

Fixed · RHSA-2011:1379
Red Hat Enterprise Linux 4

krb5

Not affected
Red Hat Enterprise Linux 5

krb5

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	krb5-0:1.9-9.el6_1.2	Fixed	RHSA-2011:1379
Red Hat Enterprise Linux 4	krb5	Not affected	n/a
Red Hat Enterprise Linux 5	krb5	Not affected	n/a

Remediation

No remediation recorded yet.

Metrics

3.65% 0.03653

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.03653

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (17 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	3.65% (0.03653)	89.24th	v5 (v2026.06.15)
Jun 15, 2026	3.65% (0.03653)	88.13th	v5 (v2026.06.15)
Mar 2, 2026	2.62% (0.02618)	85.46th	v4 (v2025.03.14)
Dec 14, 2025	10.10% (0.10100)	92.82th	v4 (v2025.03.14)
Nov 9, 2025	8.08% (0.08081)	91.75th	v4 (v2025.03.14)
Apr 3, 2025	3.84% (0.03837)	87.11th	v4 (v2025.03.14)
Mar 30, 2025	5.38% (0.05377)	89.13th	v4 (v2025.03.14)
Mar 29, 2025	8.21% (0.08207)	86.75th	v4 (v2025.03.14)
Mar 17, 2025	5.38% (0.05377)	89.39th	v4 (v2025.03.14)
Dec 20, 2024	61.02% (0.61018)	97.95th	v3 (v2023.03.01)
Dec 17, 2024	67.69% (0.67694)	98.13th	v3 (v2023.03.01)
Nov 5, 2024	65.65% (0.65654)	98.00th	v3 (v2023.03.01)
Mar 7, 2023	70.70% (0.70704)	97.43th	v3 (v2023.03.01)
Mar 6, 2023	1.21% (0.01213)	66.61th	v2 (v2022.01.01)
Feb 17, 2023	1.21% (0.01213)	66.22th	v2 (v2022.01.01)
Apr 1, 2022	1.21% (0.01213)	64.21th	v2 (v2022.01.01)
Feb 4, 2022	1.21% (0.01213)	40.54th	v2 (v2022.01.01)

Weaknesses (1)

CWE-20

Improper Input Validation

References (9)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629558
x_refsource_CONFIRM
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt
x_refsource_CONFIRMVendor Advisory
http://www.kb.cert.org/vuls/id/659251
third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2011:159
vendor-advisoryx_refsource_MANDRIVA
http://www.redhat.com/support/errata/RHSA-2011-1379.html
vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2011-1527
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=737711
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1527
https://www.cve.org/CVERecord?id=CVE-2011-1527

Link	Providers	Tags
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=629558		x_refsource_CONFIRM
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt		x_refsource_CONFIRMVendor Advisory
http://www.kb.cert.org/vuls/id/659251		third-party-advisoryx_refsource_CERT-VNUS Government Resource
http://www.mandriva.com/security/advisories?name=MDVSA-2011:159		vendor-advisoryx_refsource_MANDRIVA
http://www.redhat.com/support/errata/RHSA-2011-1379.html		vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2011-1527		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=737711		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2011-1527
https://www.cve.org/CVERecord?id=CVE-2011-1527