CVE-2013-1417
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4...
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
Exploit likelihood
What each source reports
NVD Score used
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
- Record
CVE-2013-1417- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
- Record
CVE-2013-1417- Updated
- 2026-11-02
EUVDEUVD-2013-1455 No score
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
- Record
EUVD-2013-1455- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wfgh-cf33-x6c3 No score
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4...
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
- Record
GHSA-wfgh-cf33-x6c3- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
- Record
CVE-2013-1417- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1417 No score
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
- Record
DEBIAN-CVE-2013-1417- Updated
- 2026-11-02
OSVMGASA-2013-0336 No score
Updated krb5 package fixes security vulnerabilities
An authenticated remote client can cause a KDC to crash by making a valid TGS-REQ to a KDC serving a realm with a single-component name. The process_tgs_req() function dereferences a null pointer because an unusual failure condition causes a helper function to return success (CVE-2013-1417).
If a KDC serves multiple realms, certain requests can cause setup_server_realm() to dereference a null pointer, crashing the KDC. This can be triggered by an unauthenticated user (CVE-2013-1418).
- Record
MGASA-2013-0336- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10004-1 No score
krb5-1.15-1.1 on GA media
These are all security issues fixed in the krb5-1.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10004-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1417 No score
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
- Record
UBUNTU-CVE-2013-1417- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 |
before 1.11.3+dfsg-3+nmu1 | 1.11.3+dfsg-3+nmu1 |
krb5Debian:13 |
before 1.11.3+dfsg-3+nmu1 | 1.11.3+dfsg-3+nmu1 |
krb5Debian:14 |
before 1.11.3+dfsg-3+nmu1 | 1.11.3+dfsg-3+nmu1 |
krb5Mageia:3 |
before 1.11.1-1.3.mga3 | 1.11.1-1.3.mga3 |
krb5openSUSE:Tumbleweed |
before 1.15-1.1 | 1.15-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1417 is a low vulnerability (CVSS 3.5) in Mit Kerberos 5, published November 20, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.93%, the 80th percentile. Fixed in krb5 1.11.3+dfsg-3+nmu1.
References
bugzilla.redhat.com/show_bug.cgi?id=1030743
lists.opensuse.org/opensuse-updates/2013-12/msg00026.html
web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt
github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc
nvd.nist.gov/vuln/detail/CVE-2013-1417
Show 60 moreShow less
security-tracker.debian.org/tracker/CVE-2013-1417
advisories.mageia.org/MGASA-2013-0336.html
bugs.mageia.org/show_bug.cgi?id=11668
ubuntu.com/security/CVE-2013-1417
cve.org/CVERecord?id=CVE-2013-1417
suse.com/security/cve/CVE-2002-2443