Executive brief
Zeek, a widely used network security monitoring platform, is vulnerable to a flaw that allows remote attackers to crash the system. By sending a single specially crafted network packet, an attacker can disable the monitoring sensor, leading to a loss of visibility into network traffic and potential security blind spots. This attack requires no user interaction or login credentials to execute.
Technical details
A null pointer dereference exists in the Zeek Kerberos protocol analyzer due to a state mismatch between the parser and the analyzer. Specifically, the 'proc_padata()' function dereferences an uninitialized 'pa_data_element' field when processing a KRB_ERROR message (error-code 25, KDC_ERR_PREAUTH_REQUIRED) containing specific PA-DATA types (2, 3, 11, or 19). An unauthenticated remote attacker can trigger this crash by sending a single crafted UDP or TCP packet to port 88. This vulnerability results in a Denial of Service (DoS) of the Zeek sensor. The issue is resolved in Zeek version 8.0.9.
Affected products
- Zeek Zeek < 8.0.9
Timeline
- 2026-07-06: patched: Zeek version 8.0.9 released
- 2026-07-09: disclosed: CVE-2026-60109 published