CVE-2011-0285Kerberos 5 Vulnerability
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted…
Published Apr 15, 2011 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2011-0285
Key Facts
Patch immediately- CVE-2011-0285 is a critical-severity vulnerability (CVSS 10.0 v2) affecting Kerberos 5 (Mit), krb5 (debian), rootio-krb5 and 15 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 21% probability of exploitation in the next 30 days.
- Fixed versions are available, including krb5 0:1.8.2-3.el6_0.7, krb5 1.15-1.1, krb5 1.9.1+dfsg-1.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v2
10.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS (30-day exploit likelihood)
21%
Higher than 97.5% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
39/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.
Affected Products
39 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Kerberos 5Mit | 1.7, 1.7.1, 1.8, 1.8.1, 1.8.2, 1.8.3, 1.9 | n/a |
| krb5debian | See advisory | 1.9.1+dfsg-1 |
| rootio-krb5rootio | See advisory | 1.9.1+dfsg-1 |
| krb5-develoracle | See advisory | 1.8.2-3.el6_0.7 |
| krb5-libsoracle | See advisory | 1.8.2-3.el6_0.7 |
Patched Releases
krb5
0:1.8.2-3.el6_0.7, 1.15-1.1, 1.9.1+dfsg-1
krb5-32bit
1.15-1.1
krb5-client
1.15-1.1
krb5-devel
1.15-1.1, 1.8.2-3.el6_0.7
krb5-devel-32bit
1.15-1.1
krb5-doc
1.15-1.1
krb5-libs
1.8.2-3.el6_0.7
krb5-mini
1.15-1.1
krb5-mini-devel
1.15-1.1
krb5-pkinit-openssl
1.8.2-3.el6_0.7
krb5-plugin-kdb-ldap
1.15-1.1
krb5-plugin-preauth-otp
1.15-1.1
krb5-plugin-preauth-pkinit
1.15-1.1
krb5-server
1.15-1.1, 1.8.2-3.el6_0.7
krb5-server-ldap
1.8.2-3.el6_0.7
krb5-workstation
1.8.2-3.el6_0.7
rootio-krb5
1.9.1+dfsg-1
Timeline
Publicly disclosed
Apr 15, 2011
Last updated
Aug 4, 2026
Weakness Type
- CWE-20 Improper Input Validation
References
- advisorysecurity-tracker.debian.org · CVE-2011-0285
- advisoryRHSA-2011:0447
- patchweb.mit.edu · MITKRB5-SA-2011-004.txt
- exploitExploitDB-35606
- otherbugs.debian.org · bugreport.cgi
FAQ
Common Questions.
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error conditio…
Affected: Kerberos 5 (Mit) versions 1.7, 1.7.1, 1.8, 1.8.1, 1.8.2, 1.8.3, 1.9; krb5 (debian); rootio-krb5, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including krb5 0:1.8.2-3.el6_0.7, krb5 1.15-1.1, krb5 1.9.1+dfsg-1.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2011-0285 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo