CVE-2009-4212

CVE-2009-4212 describes multiple integer underflow vulnerabilities in the AES and RC4 decryption functions of the crypto library within MIT Kerberos 5 versions 1.3 through 1.6.3, and 1.7 before 1.7.1. This flaw allows unauthenticated remote attackers to trigger a denial of service (daemon crash) or potentially execute arbitrary code by supplying malformed, short ciphertext. The vulnerability carries a critical CVSS score of 10.0, indicating a severe risk. It is network-exploitable with low attack complexity and requires no authentication, leading to potential complete compromise of confidentiality, integrity, and availability. Despite its high severity, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting a lack of widespread attention.