Executive brief
Kerberos 4 is a network authentication protocol used to verify the identity of users and services. A flaw in how the server handles malformed network requests allows an attacker to trick the system into revealing the username of the last person who logged in, along with the internal network domain name. This information can be used by attackers to launch targeted password-guessing attacks against specific user accounts.
Technical details
A vulnerability in Kerberos 4 arises from the use of un-sanitized data structures when generating error responses for malformed UDP packets. When a server receives a packet that is shorter than expected (such as a single null byte), it fails to clear internal buffers before returning an error string. This error message inadvertently includes the principal name (username) and realm name of the most recent user to request a Ticket Granting Ticket (TGT). An attacker can repeatedly query the server to harvest usernames and then perform offline dictionary attacks against the TGTs of those users. This issue does not affect Kerberos 5.
Affected products
- MIT Kerberos 4
Timeline
- 1996-11-22: disclosed: L0pht Security Advisory released
- 1996-11-22: advisory: NVD publication date