This flaw has commonly been referred to as CVE-1999-0103 because that CVE also describes a UDP ping-pong attack. The same type of issue exists in kadmind's kpasswd handling, but unfortunately no one told upstream for the last decade. CVE-1999-0103 never mentioned krb5 in any way other than with regards to a Nessus plugin that tests for the CVE-1999-0103 weakness in kpasswd handling. Upstream now knows and a fix is available. Cut-n-paste from our bug report follows: A flaw in certain programs that handle UDP traffic was discovered and assigned the name CVE-1999-0103 (that CVE specifically mentions echo and chargen as vulnerable). In 2002, a Nessus plugin was included [1] that reference this CVE name, but was for the kpasswd service. Until recently, this issue had not been reported upstream. This issue has since been reported upstream [2] and is now fixed [3]. If a malicious remote user were to spoof their IP address to that of another server running kadmind with the password change port (kpasswd, port 464), or to the target server's IP address itself), kpasswd will pass UDP packets to the spoofed address and reply each time. This can be used to consume bandwidth and CPU on the affected servers running kadmind. This should be fixed in the for krb5-1.11.3 release. [1] http://marc.info/?l=nessus&m=102418951803893&w=2 [2] http://krbdev.mit.edu/rt/Ticket/Display.html?id=7637 [3] https://github.com/krb5/krb5/commit/cf1a0c411b2668c57c41e9c4efd15ba17b6b322c After discussing with upstream and MITRE, it was decided that this issue needed its own CVE name, so it was assigned CVE-2002-2443. I can't find an email address for Tenable, so I'll probably just use their contact form and post to the archive for this message so they can adjust the name of that particular script.