CVE-2012-1016

What it actually does

NULL pointer dereference in pkinit_server_return_padata triggered by a crafted Draft 9 PKINIT request, causing the KDC daemon to crash.

Why it matters to the business

Remote attackers can interrupt Kerberos authentication services, blocking user logins and access to protected resources across the environment.

How an attack unfolds

An attacker sends a specially crafted Draft 9 PKINIT preauthentication request to the KDC; the pkinit_server_return_padata function attempts an agility KDF lookup in an invalid context, dereferences a NULL pointer, and terminates the daemon.

How to fix it

Upgrade MIT Kerberos 5 to version 1.10.4 or later; if immediate upgrade is not possible, restrict network access to the KDC and monitor for crashes.

How to confirm the fix worked

Verify installed krb5 version is 1.10.4 or newer; confirm absence of the vulnerable pkinit_srv.c code path; test KDC stability under simulated Draft 9 requests in a lab environment.

Typical attack path

1. Craft and transmit a Draft 9 PKINIT request to the KDC
2. pkinit_server_return_padata enters inappropriate code path
3. NULL pointer dereference occurs
4. KDC process crashes and authentication service becomes unavailable

How to detect it

Search KDC system and application logs for repeated daemon crashes or segmentation faults around pkinit code; inspect network captures for anomalous Draft 9 PKINIT preauth messages; correlate crash timestamps with connection attempts to the KDC.

• pkinit_server_return_padata
• NULL pointer dereference
• Draft 9 request
• krb5kdc.*crash

What your security team should do

• Apply the 1.10.4 (or newer) update to all KDC instances without delay
• Harden network access controls to limit KDC exposure
• Enable detailed KDC logging and set up alerts for unexpected daemon restarts
• Review and test any custom PKINIT configurations for Draft 9 compatibility