{"id":"CVE-2017-17439","details":"In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault. This is related to the _kdc_as_rep function in kdc/kerberos5.c and the der_length_visible_string function in lib/asn1/der_length.c.","modified":"2026-07-08T12:40:56.368556Z","published":"2017-12-06T15:29:00.250Z","related":["openSUSE-SU-2024:10946-1"],"database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux","cpes":["cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"]}]},"references":[{"type":"WEB","url":"http://www.h5l.org/pipermail/heimdal-announce/2017-December/000008.html"},{"type":"ADVISORY","url":"http://h5l.org/advisories.html?show=2017-12-08"},{"type":"ADVISORY","url":"http://www.h5l.org/pipermail/heimdal-discuss/2017-August/000259.html"},{"type":"ADVISORY","url":"https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887"},{"type":"ADVISORY","url":"https://www.debian.org/security/2017/dsa-4055"},{"type":"REPORT","url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=878144"},{"type":"FIX","url":"https://github.com/heimdal/heimdal/issues/353"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/heimdal/heimdal","events":[{"introduced":"0"},{"last_affected":"a3d72c604378e0bff787cc426f2b17f75b112dce"},{"fixed":"1a6a6e462dc2ac6111f9e02c6852ddec4849b887"}],"database_specific":{"cpe":"cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"7.4.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["heimdal-1.3.0pre1","heimdal-7.4.0","heimdal-7.3.0","heimdal-7.2.0","heimdal-7.1.0","heimdal-7.0.3","heimdal-7.0.2","heimdal-7.0.1","heimdal-7.1rc1","git2svn-syncpoint-master","heimdal-1.5pre2","heimdal-1.5pre1","upstream-1.4.0+git20110220.dfsg.1","upstream-1.4.0+git20101228.dfsg.1","heimdal-1.3.0rc1","heimdal-1.3.0pre11","heimdal-1.3.0pre10","heimdal-1.3.0pre9","heimdal-1.3.0pre8","heimdal-1.3.0pre7","heimdal-1.3.0pre6","heimdal-1.3.0pre5","heimdal-1.3.0pre4","heimdal-1.3.0pre3","switch-from-svn-to-git"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-17439.json","vanir_signatures_modified":"2026-07-08T12:40:56Z","vanir_signatures":[{"id":"CVE-2017-17439-45d566d2","signature_type":"Line","signature_version":"v1","source":"https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887","target":{"file":"kdc/kerberos5.c"},"deprecated":false,"digest":{"line_hashes":["184552108741995966909798273234929043718","31157069625652692581562993520782672132","92289731964834894266176103875665865520","220543229444911101941918136132963866440","68088921273738415772594604441004796928","289623454940078461526621765045642131000","19653521005183287255750554540954066757","238734535077344973939955929287016383729","198986556732662134247394704136678794791","172798049371050135097062238087022251110","333345530607291890332505461811148112806","197736238020111757745263551938246121115"],"threshold":0.9}},{"source":"https://github.com/heimdal/heimdal/commit/1a6a6e462dc2ac6111f9e02c6852ddec4849b887","target":{"file":"kdc/kerberos5.c","function":"_kdc_as_rep"},"deprecated":false,"digest":{"function_hash":"319009278022935075940704152087705260197","length":15811},"id":"CVE-2017-17439-fa1b0857","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}