CVE-2025-3576: Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.
Other sources
Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions
— Microsoft
Under specific configurations where RC4-HMAC-MD5 is negotiated for GSSAPI-secured communication, attackers can sniff messages and use MD5 collision techniques to craft altered messages that retain the same MIC (Message Integrity Code). The vulnerable checksum function from RFC4757 allows this due to its flawed use of MD5. The attack relies on RC4 being chosen over stronger encryption options and presumes attacker access to the network traffic.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3576?
CVE-2025-3576 has a severity rating that indicates a significant security risk due to its potential for message spoofing.
How do I fix CVE-2025-3576?
To fix CVE-2025-3576, update your MIT Kerberos implementation to a version that disables or mitigates the use of RC4-HMAC-MD5.
Who is affected by CVE-2025-3576?
CVE-2025-3576 affects users of the MIT Kerberos implementation that allows the use of GSSAPI with RC4-HMAC-MD5.
What attack vectors are associated with CVE-2025-3576?
CVE-2025-3576 can be exploited through MITD messages, where an attacker can use MD5 collisions to spoof integrity protections.
Is there a workaround for CVE-2025-3576?
A temporary workaround for CVE-2025-3576 includes configuring the system to prefer stronger encryption methods over RC4.