CVE-2002-2443: canonical ubuntu_linux Improper Input Validation
Vulnerability summary
CVE-2002-2443 is a medium (CVSS 5.0) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 6.18% chance of exploitation in the next 30 days, higher than 93.5% of scored vulnerabilities.
Not severe (CVSS 5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 29-05-2013PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
6.18%
Chance of exploitation in the next 30 days
Percentile
94%
Versus all other CVEs
30-day change
Decrease -0.25 pp
From 6.43% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Redhat13 products
- enterprise_linux_desktop5.0 | 6.0
- enterprise_linux_eus5.9 | 6.4
- enterprise_linux_server5.0 | 6.0
- enterprise_linux_server_aus6.4
- enterprise_linux_workstation5.0 | 6.0
Debian2 products
- krb5< 1.8.3+dfsg-4squeeze7 | < 1.10.1+dfsg-5+deb7u1 | < 1.10.1+dfsg-6
- debian_linuxEOL6.0 | 7.0 | 8.0
Mageia2 products
- krb5< 1.9.2-2.6.mga2
- krb5< 1.11.1-1.2.mga3
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 15.04 | 15.10
Fedoraproject1 product
- fedoraEOL17 | 18 | 19
Mit1 product
- kerberos_5< 1.11.3
Opensuse1 product
- opensuseEOL11.4 | 12.2 | 12.3
Ubuntu1 product
- krb5< 1.11.3+dfsg-3ubuntu2
8 vendors · 22 products
References
23 links- lists.fedoraproject.org/pipermail/package-announce/2013-May/106698.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- lists.opensuse.org/opensuse-updates/2013-07/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-updates/2013-07/msg00007.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- github.com/krb5/krb5/commit/cf1a0c411b2668c57c41e9c4efd15ba17b6b322cX Refsource CONFIRMPatchThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2013-May/105978.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2013-May/105879.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=962531X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
Show all 23 references
- www.mandriva.com/security/advisories?name=MDVSA-2013:166Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
