The Kerberos Telnet protocol, as implemented by KTH Kerberos IV and Kerberos V (Heimdal), does not encrypt authentication and encryption options sent from the server, which allows remote attackers to downgrade authentication and encryption mechanisms via a man-in-the-middle attack.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kth_kerberos | Kth | 4 (including) | 4 (including) |
| Kth_kerberos | Kth | 5 (including) | 5 (including) |