CVE-2004-0644

Description

The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding.

How to fix CVE-2004-0644

To remediate CVE-2004-0644, upgrade the affected package to a fixed version below.

• Debian/krb5—upgrade to 1.3.4-3 or later

Is CVE-2004-0644 being exploited?

Moderate — EPSS is 9.0%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• from 0, < 1.3.4-3

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2004-0644