https://feed.craftedsignal.io/products/zeek--8.0.9/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 09 Jul 2026 15:20:09 +0000https://feed.craftedsignal.io/briefs/2026-07-zeek-kerberos-dos/Thu, 09 Jul 2026 15:20:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-zeek-kerberos-dos/A null pointer dereference vulnerability (CVE-2026-60109) exists in Zeek's Kerberos protocol analyzer before version 8.0.9, allowing unauthenticated remote attackers to crash a Zeek sensor by sending a specially crafted KRB_ERROR message with error-code 25 and specific PA-DATA elements, leading to a denial-of-service condition.A critical denial-of-service vulnerability, identified as CVE-2026-60109, impacts Zeek versions prior to 8.0.9. This flaw resides within Zeek's Kerberos protocol analyzer, specifically due to a null pointer dereference. Unauthenticated remote attackers can exploit this vulnerability by sending a meticulously crafted KRB_ERROR message. The malicious message must contain error-code 25 (KDC_ERR_PREAUTH_REQUIRED) and include a PA-DATA element with padata-type 2, 3, 11, or 19. This specific combination triggers a mismatch between the parser and analyzer states, leading proc_padata() to dereference an uninitialized pa_data_element field. The exploitation requires only a single UDP or TCP packet sent to port 88, without requiring any credentials or prior authentication, and results in the Zeek sensor crashing, effectively causing a denial of service.

Attack Chain

1. An unauthenticated remote attacker crafts a specialized Kerberos KRB_ERROR message.
2. The crafted message includes error-code 25, which corresponds to KDC_ERR_PREAUTH_REQUIRED.
3. Within the KRB_ERROR message, a PA-DATA element is embedded with a padata-type specifically set to 2, 3, 11, or 19.
4. The attacker sends this single, malformed UDP or TCP packet to a vulnerable Zeek sensor's port 88.
5. The Zeek sensor's Kerberos protocol analyzer, proc_padata(), attempts to process the incoming KRB_ERROR message.
6. Due to an internal parser and analyzer state mismatch, proc_padata() incorrectly dereferences an uninitialized pa_data_element field.
7. This dereference of a null pointer causes a critical error within the Zeek application.
8. The Zeek sensor application crashes entirely, resulting in a denial-of-service condition for network monitoring and analysis.

Impact

The successful exploitation of CVE-2026-60109 leads directly to a denial-of-service (DoS) for the affected Zeek sensor. This means that organizations relying on Zeek for network security monitoring, intrusion detection, or forensic analysis will temporarily lose visibility into their network traffic from the crashed sensor. The impact can be severe for organizations with critical network infrastructure or strict compliance requirements, as it can create blind spots for threat detection and incident response, potentially allowing other malicious activities to go unnoticed while the sensor is offline.

Recommendation

• Prioritize patching Zeek instances to version 8.0.9 or later immediately to remediate CVE-2026-60109.
• Monitor network traffic for unusual Kerberos KRB_ERROR messages specifically targeting port 88 with error-code 25 and PA-DATA elements containing padata-type 2, 3, 11, or 19. While detailed detection requires deep packet inspection, anomalous traffic patterns can be indicators.

]]>mediumadvisoryvulnerabilitynetworkdoszeekkerberoshttps://feed.craftedsignal.io/briefs/2026-07-zeek-ftp-dos/Thu, 09 Jul 2026 15:19:23 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-zeek-ftp-dos/An uncontrolled memory consumption vulnerability in the Zeek FTP analyzer, versions prior to 8.0.9, allows unauthenticated remote attackers to cause process termination and denial of service of the Zeek sensor. This occurs when a crafted FTP control session with AUTH GSSAPI and a large ADAT control line exploits the NVT_Analyzer component's lack of a maximum line length check, leading to an unbounded internal buffer during base64 decoding.Zeek before 8.0.9 contains an uncontrolled memory consumption vulnerability in the FTP analyzer that allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. Attackers can exploit the NVT_Analyzer component's lack of a maximum line length check, causing it to continuously double its internal buffer without bounds during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor. This vulnerability, tracked as CVE-2026-60108, impacts versions prior to 8.0.9 and poses a significant risk to the availability and stability of network monitoring operations where Zeek sensors are deployed, as it can be triggered remotely without authentication.

Attack Chain

1. Unauthenticated remote attacker establishes an FTP control connection to a vulnerable Zeek sensor.
2. Attacker sends a crafted FTP command to initiate GSSAPI authentication negotiation within the session.
3. Zeek's FTP analyzer, specifically the NVT_Analyzer component, begins processing the GSSAPI authentication.
4. Attacker sends an excessively large Authentication Data (ADAT) control line within the ongoing FTP control session.
5. The NVT_Analyzer attempts to base64 decode the large ADAT token without an internal buffer size limit.
6. The NVT_Analyzer continuously allocates and reallocates memory, doubling its buffer size without bounds, in an attempt to handle the oversized input.
7. This uncontrolled memory consumption rapidly exhausts the Zeek sensor's available system resources.
8. The Zeek sensor process terminates unexpectedly, resulting in a complete denial of service for the network monitoring system.

Impact

The successful exploitation of CVE-2026-60108 results in the unauthenticated remote termination of the Zeek sensor process. This leads to a denial of service, rendering the Zeek instance incapable of network traffic analysis and security monitoring. For organizations relying on Zeek for critical threat detection, incident response, and compliance logging, this means a complete loss of visibility over network activity during the attack, potentially allowing other malicious activities to go undetected.

Recommendation

• Patch CVE-2026-60108 immediately by updating all affected Zeek installations to version 8.0.9 or later to address the uncontrolled memory consumption vulnerability.

]]>mediumadvisorycvedoszeeknetwork-protocolvulnerability