CVE-2009-3295
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in...
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
Exploit likelihood
What each source reports
NVD Score used
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
- Record
CVE-2009-3295- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
- Record
CVE-2009-3295- Updated
- 2026-11-02
EUVDEUVD-2009-3277 No score
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
- Record
EUVD-2009-3277- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m68p-v7vm-cp2m No score
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in...
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
- Record
GHSA-m68p-v7vm-cp2m- Updated
- 2026-11-02
OSV No score
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
- Record
CVE-2009-3295- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3295 No score
The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm referral implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a ticket request.
- Record
DEBIAN-CVE-2009-3295- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10004-1 No score
krb5-1.15-1.1 on GA media
These are all security issues fixed in the krb5-1.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10004-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3295 is a medium vulnerability (CVSS 5.0) in Mit Kerberos 5, published December 29, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 40.3%, the 98th percentile. Fixed in krb5 1.7+dfsg-4.
References
secunia.com/advisories/37977
vupen.com/english/advisories/2009/3652
securitytracker.com/id?1023392
securityfocus.com/bid/37486
web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-003.txt
Show 57 moreShow less
nvd.nist.gov/vuln/detail/CVE-2009-3295
github.com/advisories/GHSA-m68p-v7vm-cp2m
security-tracker.debian.org/tracker/CVE-2009-3295
suse.com/security/cve/CVE-2002-2443