{"id":"CVE-2017-17439","details":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","modified":"2026-05-18T05:49:53.724618938Z","published":"2017-12-06T15:29:00.250Z","related":["openSUSE-SU-2024:10946-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_FIELD","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"last_affected":"9.0"}]}]},"references":[{"type":"WEB","url":"http://www.h5l.org/pipermail/heimdal-announce/2017-December/000008.html"},{"type":"ADVISORY","url":"http://h5l.org/advisories.html?show=2017-12-08"},{"type":"ADVISORY","url":"http://www.h5l.org/pipermail/heimdal-discuss/2017-August/000259.html"},{"type":"ADVISORY","url":"https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887"},{"type":"ADVISORY","url":"https://www.debian.org/security/2017/dsa-4055"},{"type":"REPORT","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878144"},{"type":"FIX","url":"https://github.com/heimdal/heimdal/issues/353"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/heimdal/heimdal","events":[{"introduced":"0"},{"last_affected":"a3d72c604378e0bff787cc426f2b17f75b112dce"}],"database_specific":{"source":"CPE_FIELD","cpe":"cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"7.4.0"}]}}],"versions":["heimdal-1.3.0pre1","heimdal-7.4.0","heimdal-7.3.0","heimdal-7.2.0","heimdal-7.1.0","heimdal-7.0.3","heimdal-7.0.2","heimdal-7.0.1","heimdal-7.1rc1","git2svn-syncpoint-master","heimdal-1.5pre2","heimdal-1.5pre1","upstream-1.4.0+git20110220.dfsg.1","upstream-1.4.0+git20101228.dfsg.1","heimdal-1.3.0rc1","heimdal-1.3.0pre11","heimdal-1.3.0pre10","heimdal-1.3.0pre9","heimdal-1.3.0pre8","heimdal-1.3.0pre7","heimdal-1.3.0pre6","heimdal-1.3.0pre5","heimdal-1.3.0pre4","heimdal-1.3.0pre3","switch-from-svn-to-git"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-17439.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}