Is CVE-1999-1099 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-1999-1099 being exploited in the wild.

How severe is CVE-1999-1099?

Medium severity, with a CVSS score of 5, published 22 November 1996.

Is there a fix for CVE-1999-1099?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-1999-1099 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-1999-1099?

Check whether you run Kth Kerberos or Mit Kerberos 4. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-1999-1099: MIT Kerberos 4 Information Disclosure via Malformed UDP Packet

CVE-1999-1099 · Severity: medium · CVSS 5 · Published 1996-11-22

Kerberos 4 is a network authentication protocol used to verify the identity of users and services. A flaw in how the server handles malformed network requests allows an attacker to trick the system into revealing the username of the last person who logged in, along with the internal network domain name. This information can be used by attackers to launch targeted password-guessing attacks against specific user accounts.

Vendors: Mit.

Quick answers

Is CVE-1999-1099 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-1999-1099 being exploited in the wild.
How severe is CVE-1999-1099?: Medium severity, with a CVSS score of 5, published 22 November 1996.
Which products and versions are affected?: MIT Kerberos 4.
Is there a fix for CVE-1999-1099?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-1999-1099 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-1999-1099?: Check whether you run Kth Kerberos or Mit Kerberos 4. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Kerberos 4 arises from the use of un-sanitized data structures when generating error responses for malformed UDP packets. When a server receives a packet that is shorter than expected (such as a single null byte), it fails to clear internal buffers before returning an error string. This error message inadvertently includes the principal name (username) and realm name of the most recent user to request a Ticket Granting Ticket (TGT). An attacker can repeatedly query the server to harvest usernames and then perform offline dictionary attacks against the TGTs of those users. This issue does not affect Kerberos 5.

Affected products

MIT Kerberos 4

Timeline

1996-11-22: disclosed: L0pht Security Advisory released
1996-11-22: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.