Null Pointer Dereference in Zeek Kerberos Analyzer

Executive Summary

CVE-2026-60109 is a null pointer dereference vulnerability in the Kerberos protocol analyzer of Zeek versions before 8.0.9. It occurs when an unauthenticated remote attacker sends a specially crafted KRB_ERROR message with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19. Due to a mismatch between the parser and analyzer states, the proc_padata() function dereferences an uninitialized pa_data_element field, causing the sensor to crash.

This crash can be triggered by a single UDP or TCP packet sent to port 88 without requiring any credentials or prior authentication.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to cause a denial-of-service (DoS) condition by crashing the Zeek sensor. The crash disrupts network monitoring and analysis, potentially leading to loss of visibility into network traffic and security events.

Since the attack requires no credentials and can be executed with a single crafted packet, it poses a high risk of service interruption.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic for specially crafted Kerberos KRB_ERROR messages with error-code 25 (KDC_ERR_PREAUTH_REQUIRED) that contain PA-DATA elements with padata-type 2, 3, 11, or 19.

Detection involves capturing and inspecting UDP or TCP packets sent to port 88 (Kerberos) for these specific malformed packets that trigger the null pointer dereference.

While no explicit commands are provided in the resources, you can use packet capture tools like tcpdump or Wireshark to filter and analyze such traffic. For example, a tcpdump command to capture Kerberos traffic might be:

• tcpdump -i <interface> port 88

Then, analyze captured packets for KRB_ERROR messages with error-code 25 and PA-DATA elements with the specified padata-types using a protocol analyzer or custom scripts.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Zeek to version 8.0.9 or later, where this vulnerability has been patched.

The patch fixes the vulnerability by modifying the Kerberos protocol analyzer to properly handle error cases and avoid dereferencing uninitialized data, preventing crashes.

Until the upgrade can be applied, consider blocking or filtering incoming UDP and TCP traffic to port 88 from untrusted sources to reduce exposure to crafted malicious packets.

Useful 0 Not Useful 0