CVE-2002-2443

What it actually does

The kpasswd service in kadmind fails to validate incoming UDP packets, allowing a forged packet to trigger an amplification loop between the server and a third party or itself, exhausting CPU and network bandwidth.

Why it matters to the business

Authentication and password change services become unavailable, disrupting user access, administrative operations, and potentially halting business processes that rely on Kerberos for identity management.

How an attack unfolds

An attacker sends a single crafted UDP packet to the kpasswd service that elicits a response directed at another host or the original sender, creating a sustained communication loop that amplifies traffic until resources are exhausted.

How to fix it

Upgrade MIT Kerberos 5 to version 1.11.3 or later on all affected systems; apply vendor-specific patches for distributions such as Red Hat, Debian, Ubuntu, Fedora, and openSUSE that include the fix in schpw.c.

How to confirm the fix worked

Verify installed krb5 package version is at least 1.11.3; re-test the service with packet validation tools or the original krb_pingpong.nasl script to confirm the loop condition no longer triggers.

Typical attack path

1. Identify exposed kadmind kpasswd UDP service
2. Craft and transmit a forged UDP packet mimicking a valid response
3. Initiate the packet exchange loop with a third-party host
4. Sustain the loop to consume CPU and bandwidth leading to denial of service

How to detect it

Review kadmind and system logs for repeated UDP exchanges on port 464 without corresponding legitimate kpasswd requests; correlate with sudden spikes in CPU usage on the Kerberos server.

• UDP packets to/from port 464 containing schpw.c response patterns
• krb_pingpong.nasl strings in network captures
• sustained high-volume UDP loops between kadmind and external hosts

What your security team should do

• Prioritize upgrade of all Kerberos 5 deployments to 1.11.3+ given the public exploit maturity and long disclosure window
• Restrict UDP access to kpasswd (port 464) to trusted networks only
• Implement network-level rate limiting and monitoring for anomalous UDP traffic volumes on kadmind