CVE-2002-2443: schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly vali...

Security readout for executives and security teams

This issue can let a remote attacker make vulnerable MIT Kerberos password-change services waste CPU and bandwidth by causing response loops over UDP. It threatens availability of Kerberos administration or password-change infrastructure, not confidentiality or direct system takeover based on the provided sources. Exposure is most likely on systems running MIT krb5 kadmind/kpasswd from before 1.11.3, especially where UDP access to Kerberos password-change or administration services is reachable from untrusted networks. Treat as a targeted availability risk to identity infrastructure. Prioritize remediation if Kerberos admin or password-change services are externally reachable or support critical authentication workflows. Mitigation focus: Apply vendor krb5 security updates from affected Linux distributions.; Upgrade MIT Kerberos 5 to 1.11.3 or a vendor-fixed package.; Restrict untrusted UDP access to Kerberos administration and password-change services..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.