The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0067 advisory.

    This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 8.6. It addresses 72 CVEs:
    CVE-2008-0947, CVE-2016-3120, CVE-2012-1014, CVE-2017-15088, CVE-2014-9422, and 67 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0439 advisory.

    This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.2. It addresses 74 CVEs:
    CVE-2008-0947, CVE-2016-3120, CVE-2012-1014, CVE-2017-15088, CVE-2014-9422, and 69 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1422 advisory.

    This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.6. It addresses 80 CVEs:
    CVE-2009-0845, CVE-2008-0947, CVE-2016-3120, CVE-2024-3596, CVE-2012-1014, and 75 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has krb5 packages installed that are affected by multiple vulnerabilities:

  - plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles     Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial     of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related     to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use     cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin     code that is specific to Red Hat. (CVE-2017-15088)

  - The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT     Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute     arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error     condition. (CVE-2011-0285)

  - schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly     validate UDP packets before sending responses, which allows remote attackers to cause a denial of service     (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by     krb_pingpong.nasl, a related issue to CVE-1999-0103. (CVE-2002-2443)

  - The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b)     Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to     gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known     whether an exploitable attack scenario exists for these issues. (CVE-2006-3084)

  - The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration     daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in     freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute     arbitrary code via unspecified vectors. (CVE-2006-6143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06, has krb5 packages installed that are affected by multiple vulnerabilities:

  - plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles     Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial     of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related     to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use     cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin     code that is specific to Red Hat. (CVE-2017-15088)

  - The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT     Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute     arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error     condition. (CVE-2011-0285)

  - schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly     validate UDP packets before sending responses, which allows remote attackers to cause a denial of service     (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by     krb_pingpong.nasl, a related issue to CVE-1999-0103. (CVE-2002-2443)

  - The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b)     Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to     gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known     whether an exploitable attack scenario exists for these issues. (CVE-2006-3084)

  - The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration     daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in     freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute     arbitrary code via unspecified vectors. (CVE-2006-6143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14     allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an     initial '\0' character in a long realm field within a TGS request. (CVE-2015-2697)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201611-14 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

krb5 was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2695: Applications which call     gss_inquire_context() on a partially-established SPNEGO     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952188).

  - CVE-2015-2696: Applications which call     gss_inquire_context() on a partially-established IAKERB     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952189).

  - CVE-2015-2697: Incorrect string handling in     build_principal_va can lead to DOS (bsc#952190).

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2810-1 advisory.

    It was discovered that the Kerberos kpasswd service incorrectly handled certain UDP packets. A remote     attacker could possibly use this issue to cause resource consumption, resulting in a denial of service.
    This issue only affected Ubuntu 12.04 LTS. (CVE-2002-2443)

    It was discovered that Kerberos incorrectly handled null bytes in certain data fields. A remote attacker     could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and     Ubuntu 14.04 LTS. (CVE-2014-5355)

    It was discovered that the Kerberos kdcpreauth modules incorrectly tracked certain client requests. A     remote attacker could possibly use this issue to bypass intended preauthentication requirements. This     issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2694)

    It was discovered that Kerberos incorrectly handled certain SPNEGO packets. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2015-2695)

    It was discovered that Kerberos incorrectly handled certain IAKERB packets. A remote attacker could     possibly use this issue to cause a denial of service. (CVE-2015-2696, CVE-2015-2698)

    It was discovered that Kerberos incorrectly handled certain TGS requests. A remote attacker could possibly     use this issue to cause a denial of service. (CVE-2015-2697)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-2695     It was discovered that applications which call     gss_inquire_context() on a partially-established SPNEGO     context can cause the GSS-API library to read from a     pointer using the wrong type, leading to a process     crash.

  - CVE-2015-2696     It was discovered that applications which call     gss_inquire_context() on a partially-established IAKERB     context can cause the GSS-API library to read from a     pointer using the wrong type, leading to a process     crash.

  - CVE-2015-2697     It was discovered that the build_principal_va() function     incorrectly handles input strings. An authenticated     attacker can take advantage of this flaw to cause a KDC     to crash using a TGS request with a large realm field     beginning with a null byte.

CVE-2015-2695

It was discovered that applications which call gss_inquire_context() on a partially-established SPNEGO context can cause the GSS-API library to read from a pointer using the wrong type, leading to a process crash.

CVE-2015-2697

It was discovered that the build_principal_va() function incorrectly handles input strings. An authenticated attacker can take advantage of this flaw to cause a KDC to crash using a TGS request with a large realm field beginning with a null byte.

For the oldoldstable distribution (squeeze), these problems have been fixed in version 1.8.3+dfsg-4squeeze10.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

krb5 was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2695: Applications which call     gss_inquire_context() on a partially-established SPNEGO     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952188).

  - CVE-2015-2696: Applications which call     gss_inquire_context() on a partially-established IAKERB     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952189).

  - CVE-2015-2697: Incorrect string handling in     build_principal_va can lead to DOS (bsc#952190).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
358952	Rocky Linux 8.6 [CIQ] Security Update: krb5-devel / krb5-devel-debuginfo / krb5-libs / krb5-libs-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0067)	Nessus	Rocky Linux Local Security Checks	Local	critical
355341	Rocky Linux 9.2 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-libs-debuginfo / krb5-pkinit / etc Multiple Vulnerabilities (ciqsa-2026_0439)	Nessus	Rocky Linux Local Security Checks	Local	critical
354310	Rocky Linux 9.6 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ciqsa-2026_1422)	Nessus	Rocky Linux Local Security Checks	Local	critical
301200	NewStart CGSL MAIN 6.06 (SP) : krb5 Multiple Vulnerabilities (NS-SA-2026-0007)	Nessus	NewStart CGSL Local Security Checks	Local	critical
266225	NewStart CGSL MAIN 6.06 : krb5 Multiple Vulnerabilities (NS-SA-2025-0215)	Nessus	NewStart CGSL Local Security Checks	Local	critical
218862	Linux Distros Unpatched Vulnerability : CVE-2015-2697	Nessus	Misc.	Local	high
95021	GLSA-201611-14 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	high
86963	openSUSE Security Update : krb5 (openSUSE-2015-740)	Nessus	SuSE Local Security Checks	Local	high
86872	Ubuntu 14.04 LTS : Kerberos vulnerabilities (USN-2810-1)	Nessus	Ubuntu Local Security Checks	Local	high
86800	openSUSE Security Update : krb5 (openSUSE-2015-709)	Nessus	SuSE Local Security Checks	Local	high
86795	Debian DSA-3395-1 : krb5 - security update	Nessus	Debian Local Security Checks	Local	high
86793	Debian DLA-340-1 : krb5 security update	Nessus	Debian Local Security Checks	Local	high
86754	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2015:1897-1)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2015-2697

medium

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

high

high

high

high

high