CVE-2002-1235: Debian Linux

High severity, CVSS 10.0. EPSS: 15.1% chance of exploitation in the next 30 days.

The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.

Affected products

• Debian Debian Linux: version 3.0 only
• Kth Kth Kerberos 4: before 1.2.1 (fixed in 1.2.1)
• Kth Kth Kerberos 5: before 0.5.1 (fixed in 0.5.1)
• Mit Kerberos 5: from 1.0, up to and including 1.2.6

Published 2002-11-04. Last modified 2026-06-16.