{"id":"CVE-2017-17439","aliases":["ALPINE-CVE-2017-17439","BELL-CVE-2017-17439","DEBIAN-CVE-2017-17439","DSA-4055-1","EUVD-2017-8603","GHSA-gc5p-r2vh-qc88","MGASA-2017-0485","UBUNTU-CVE-2017-17439","openSUSE-SU-2024:10946-1"],"status":"published","title":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a...","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03427,"percentile":0.89007,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2017-12-06T15:00:00Z","modified":"2026-10-20T13:21:16Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"heimdal","fixed_in":["7.1.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"heimdal","fixed_in":["7.4.0-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"heimdal","fixed_in":["7.5.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"heimdal","fixed_in":["7.5.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"heimdal","fixed_in":["7.5.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"heimdal","fixed_in":["7.1.0+dfsg-13+deb9u2"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"heimdal","fixed_in":["7.3.0-1.2.mga6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.0-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0+dfsg-13+deb9u2"}]}],"versions":["7.1.0+dfsg-13","7.1.0+dfsg-13+deb9u1"]},{"source":"osv","ecosystem":"Mageia:6","package":"heimdal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.0-1.2.mga6"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"heimdal_project","product":"heimdal"}],"references":[{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878144","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","report"]},{"url":"https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.h5l.org/pipermail/heimdal-announce/2017-December/000008.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.h5l.org/pipermail/heimdal-discuss/2017-August/000259.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://github.com/heimdal/heimdal/issues/353","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://h5l.org/advisories.html?show=2017-12-08","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4055","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17439"},{"url":"https://github.com/advisories/GHSA-gc5p-r2vh-qc88"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-17439","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-17439","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17439","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0485.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-17439","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17439","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6594","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12098","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-17439","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"published","published":"2017-12-06T15:00:00Z","modified":"2024-08-05T20:51:31.511Z","updated_at":"2026-11-02T14:33:18.556155Z"}],"euvd":[{"id":"EUVD-2017-8603","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"published","published":"2017-12-06T15:00:00Z","modified":"2024-08-05T20:51:31Z","updated_at":"2026-11-03T02:23:10.087185Z"}],"ghsa":[{"id":"GHSA-gc5p-r2vh-qc88","title":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a...","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"published","published":"2022-05-14T04:01:33Z","modified":"2023-02-03T05:01:03Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:52:54.419005Z"}],"nvd":[{"id":"CVE-2017-17439","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"published","published":"2017-12-06T15:29:00.25Z","modified":"2026-06-17T01:10:48.137Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:10.156892Z"}],"osv":[{"id":"ALPINE-CVE-2017-17439","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"published","published":"2017-12-06T15:29:00.25Z","modified":"2026-06-15T18:18:06.782580234Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-17439","title":"CVE-2017-17439 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:17.31155Z","modified":"2026-01-26T09:46:24.304293Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-17439","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"published","published":"2017-12-06T15:29:00.25Z","modified":"2026-10-20T13:21:16.119238134Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17439","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"published","published":"2017-12-06T15:29:00.25Z","modified":"2026-09-01T20:03:45.473413638Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-17439","description":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","status":"withdrawn","published":"2017-12-06T15:29:00Z","modified":"2025-07-16T06:30:46.209935Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"DSA-4055-1","title":"heimdal - security update","status":"published","published":"2017-12-07T00:00:00Z","modified":"2026-03-09T01:19:18.910001Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0485","title":"Updated heimdal packages fix security vulnerability","description":"Michael Eder and Thomas Kittel discovered that Heimdal did not correctly\nhandle ASN.1 data. This would allow an unauthenticated remote attacker\nto cause a denial of service (crash of the KDC daemon) by sending\nmaliciously crafted packets (CVE-2017-17439).\n","status":"published","published":"2017-12-31T15:14:43Z","modified":"2026-04-16T06:25:13.933946183Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10946-1","title":"libheimdal-7.7.0-1.11 on GA media","description":"These are all security issues fixed in the libheimdal-7.7.0-1.11 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:00:42.084229Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}