CVE-2004-1189
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3...
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
Exploit likelihood
What each source reports
NVD Score used
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
- Record
CVE-2004-1189- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
- Record
CVE-2004-1189- Updated
- 2026-11-02
EUVDEUVD-2004-1186 No score
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
- Record
EUVD-2004-1186- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jq9g-4vpq-449j No score
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3...
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
- Record
GHSA-jq9g-4vpq-449j- Weakness
- CWE-787
- Updated
- 2026-11-02
OSV No score
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
- Record
CVE-2004-1189- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-1189 No score
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
- Record
DEBIAN-CVE-2004-1189- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 |
before 1.3.6-1 | 1.3.6-1 |
krb5Debian:13 |
before 1.3.6-1 | 1.3.6-1 |
krb5Debian:14 |
before 1.3.6-1 | 1.3.6-1 |
krb5Debian:3.0 |
before 1.2.4-5woody7, plus listed versions 1.2.4-5woody6 |
1.2.4-5woody7 |
krb5Red Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-develRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-libsRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-serverRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-workstationRed Hat:enterprise_linux:3::as From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
krb5Red Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-develRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-libsRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-serverRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-workstationRed Hat:enterprise_linux:3::desktop From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5Red Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-develRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-libsRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-serverRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-workstationRed Hat:enterprise_linux:3::es From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5Red Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-develRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-libsRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-serverRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5-workstationRed Hat:enterprise_linux:3::ws From an advisory covering 2 CVEs |
before 0:1.2.7-38 | 0:1.2.7-38 |
krb5Red Hat:enterprise_linux:4::as |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-debuginfoRed Hat:enterprise_linux:4::as |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-develRed Hat:enterprise_linux:4::as |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-libsRed Hat:enterprise_linux:4::as |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-serverRed Hat:enterprise_linux:4::as |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-workstationRed Hat:enterprise_linux:4::as |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5Red Hat:enterprise_linux:4::desktop |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-debuginfoRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-develRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-libsRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-serverRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-workstationRed Hat:enterprise_linux:4::desktop |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5Red Hat:enterprise_linux:4::es |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-debuginfoRed Hat:enterprise_linux:4::es |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-develRed Hat:enterprise_linux:4::es |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-libsRed Hat:enterprise_linux:4::es |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-serverRed Hat:enterprise_linux:4::es |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-workstationRed Hat:enterprise_linux:4::es |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5Red Hat:enterprise_linux:4::ws |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-debuginfoRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-develRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-libsRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-serverRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-10 | 0:1.3.4-10 |
krb5-workstationRed Hat:enterprise_linux:4::ws |
before 0:1.3.4-10 | 0:1.3.4-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-1189 is a high vulnerability (CVSS 7.2) in Mit Kerberos 5, published December 31, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in krb5 1.3.6-1.
References
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000917
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11911
exchange.xforce.ibmcloud.com/vulnerabilities/18621
redhat.com/support/errata/RHSA-2005-012.html
lists.apple.com/archives/security-announce/2005/Aug/msg00000.html
marc.info?l=bugtraq&m=110548298407590&w=2
Show 27 moreShow less
web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt
trustix.org/errata/2004/0069
mandriva.com/security/advisories?name=MDKSA-2004:156
nvd.nist.gov/vuln/detail/CVE-2004-1189
github.com/advisories/GHSA-jq9g-4vpq-449j
security-tracker.debian.org/tracker/CVE-2004-1189
access.redhat.com/errata/RHSA-2005:012
securityfocus.com/bid/11289
bugzilla.redhat.com/show_bug.cgi?id=136304
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_012.json
cve.org/CVERecord?id=CVE-2004-0971