CVE-2010-0629

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-04-07 · updated 2026-06-16
Weakness: CWE-416

Description

Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.

Affected products

Canonical Ubuntu Linux: 8.04, 8.10, 9.04
Fedoraproject Fedora: 11
MIT Kerberos 5: from 1.5 through 1.6.3
Opensuse: 11.0, 11.1
SUSE Linux Enterprise: 11.0

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567052
http://krbdev.mit.edu/rt/Ticket/Display.html?id=5998
http://lists.fedoraproject.org/pipermail/package-announce/2010-April/038556.html
http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00002.html
http://secunia.com/advisories/39264
http://secunia.com/advisories/39290
http://secunia.com/advisories/39315
http://secunia.com/advisories/39324
http://secunia.com/advisories/39367
http://securitytracker.com/id?1023821
http://ubuntu.com/usn/usn-924-1
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-003.txt

Get alerted when CVE-2010-0629 or the next vulnerability affects your stack