VULNERABILITY INTELLIGENCE
CVE-2011-0285
CVSS score10 HIGH
EPSS probability20.77%
CISA KEVNot currently listed
Published2011-04-15
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Description
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.
Weakness classification
- CWE-20: Improper Input Validation