MIT Kerberos bug bounty programs

MIT Kerberos programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
MK MIT Kerberos Sorona · Bug bounty	–	–	–	$100 (highest)	$1,500	Partial	–	–	Open
MI Massachusetts Institute of Technology Self-hosted · Bug bounty	–	–	–	–	Not published	None	–	–	Open

• MK

  MIT Kerberos

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100 (highest)

  Safe harbor

  Partial

• MI

  Massachusetts Institute of Technology

  Self-hosted · Bug bounty

  Open

  Top reward

  Not published

  Safe harbor

  None

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

• atlas.mit.edu/*

  Wildcards No bounty

  Covered by Self-hosted

• bounty.mit.edu/*

  Wildcards No bounty

  Covered by Self-hosted

• learning-modules.mit.edu/*

  Wildcards No bounty

  Covered by Self-hosted

• student.mit.edu/*

  Wildcards No bounty

  Covered by Self-hosted

• https://web.mit.edu/kerberos

  Web

  Covered by Sorona

• Cross-realm trust: referral handling, transited path validation and the checks that decide whether a ticket from another realm is honoured

  Products and areas

  Covered by Sorona

• The ASN.1 encoder and decoder underneath all of it, which processes attacker-supplied structure before anything has been authenticated

  Products and areas

  Covered by Sorona

• The client library and the credential cache implementations, covering the file, keyring, memory and DIR caches and their permission models

  Products and areas

  Covered by Sorona

• The crypto layer krb5 ships, including the encryption types it still supports and the checksum implementations

  Products and areas

  Covered by Sorona

• The GSS-API implementation and the SPNEGO mechanism, which is the acceptor side every service links against

  Products and areas

  Covered by Sorona

• The kadmin service and its protocol, the password change service, and the administrative authorization rules in kadm5.acl

  Products and areas

  Covered by Sorona

• The KDB backends, covering the DB2 store and the LDAP backend, including how a hostile database entry is interpreted

  Products and areas

  Covered by Sorona

• The KDC itself: the AS and TGS exchanges, the pre-authentication mechanisms, the ticket issuance path and everything it parses from an unauthenticated requester

  Products and areas

  Covered by Sorona

• The keytab handling and the key material stored in it, along with the tools that create and manipulate keytabs

  Products and areas

  Covered by Sorona

• The kpropd replication path, which accepts a database dump over the network

  Products and areas

  Covered by Sorona

• The PAC and authorization data handling, including signature verification on the structures that carry group membership across a realm

  Products and areas

  Covered by Sorona

• The PKINIT module and its certificate validation, which is the bridge between a smartcard or a certificate and a Kerberos ticket

  Products and areas

  Covered by Sorona

• The project documents a single security contact for security problems with MIT Kerberos and draws no boundary narrower than that, so the whole krb5 tree is the target

  Products and areas

  Covered by Sorona

No target matches. Try part of a host name, such as the company name.