CVE-2002-2443: Canonical Ubuntu Linux

Medium severity, CVSS 5.0. EPSS: 6.4% chance of exploitation in the next 30 days.

schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.

Affected products

• Canonical Ubuntu Linux: version 12.04 only; version 14.04 only; version 15.04 only; version 15.10 only
• Debian Debian Linux: version 6.0 only; version 7.0 only; version 8.0 only
• Fedoraproject Fedora: version 17 only; version 18 only; version 19 only
• Mit Kerberos 5: before 1.11.3 (fixed in 1.11.3)
• Opensuse Opensuse: version 11.4 only; version 12.2 only; version 12.3 only
• Red Hat Enterprise Linux Desktop: version 5.0 only; version 6.0 only
• Red Hat Enterprise Linux Eus: version 5.9 only; version 6.4 only
• Red Hat Enterprise Linux Server: version 5.0 only; version 6.0 only
• Red Hat Enterprise Linux Server Aus: version 6.4 only
• Red Hat Enterprise Linux Workstation: version 5.0 only; version 6.0 only

Published 2013-05-29. Last modified 2026-06-16.