The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."
| Product | Vendor | Version |
|---|---|---|
| n/a | n/a | <= 5.17.* |