Skip Menu |

Subject: git commit

Multi-realm KDC null deref [CVE-2013-1418]

If a KDC serves multiple realms, certain requests can cause
setup_server_realm() to dereference a null pointer, crashing the KDC.


A related but more minor vulnerability requires authentication to
exploit, and is only present if a third-party KDC database module can
dereference a null pointer under certain conditions.

(back ported from commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf)
Author: Tom Yu <>
Commit: 05c544eef3633b774ca38154ba4c2bf3416b471b
Branch: krb5-1.11
src/kdc/main.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)