Vulnerabilities > CVE-2007-5894 - Unspecified vulnerability in MIT Kerberos 5

047910
CVSS 0.0 - NONE
Attack vector
UNKNOWN
Attack complexity
UNKNOWN
Privileges required
UNKNOWN
Confidentiality impact
UNKNOWN
Integrity impact
UNKNOWN
Availability impact
UNKNOWN
mit
nessus
NVD
Published: 2007-12-06
Updated: 2024-04-11

Summary

The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.

Vulnerable Configurations

Part Description Count
Application
Mit
1

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_KRB5-4852.NASL
    descriptionThis update fixes multiple vulnerabilties in krb5. It
    last seen2020-06-01
    modified2020-06-02
    plugin id29992
    published2008-01-16
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29992
    titleSuSE 10 Security Update : Kerberos (ZYPP Patch Number 4852)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-200803-31.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-200803-31 (MIT Kerberos 5: Multiple vulnerabilities) Two vulnerabilities were found in the Kerberos 4 support in KDC: A global variable is not set for some incoming message types, leading to a NULL pointer dereference or a double free() (CVE-2008-0062) and unused portions of a buffer are not properly cleared when generating an error message, which results in stack content being contained in a reply (CVE-2008-0063). Jeff Altman (Secure Endpoints) discovered a buffer overflow in the RPC library server code, used in the kadmin server, caused when too many file descriptors are opened (CVE-2008-0947). Venustech AD-LAB discovered multiple vulnerabilities in the GSSAPI library: usage of a freed variable in the gss_indicate_mechs() function (CVE-2007-5901) and a double free() vulnerability in the gss_krb5int_make_seal_token_v3() function (CVE-2007-5971). Impact : The first two vulnerabilities can be exploited by a remote unauthenticated attacker to execute arbitrary code on the host running krb5kdc, compromise the Kerberos key database or cause a Denial of Service. These bugs can only be triggered when Kerberos 4 support is enabled. The RPC related vulnerability can be exploited by a remote unauthenticated attacker to crash kadmind, and theoretically execute arbitrary code with root privileges or cause database corruption. This bug can only be triggered in configurations that allow large numbers of open file descriptors in a process. The GSSAPI vulnerabilities could be exploited by a remote attacker to cause Denial of Service conditions or possibly execute arbitrary code. Workaround : Kerberos 4 support can be disabled via disabling the
    last seen2020-06-01
    modified2020-06-02
    plugin id31671
    published2008-03-26
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31671
    titleGLSA-200803-31 : MIT Kerberos 5: Multiple vulnerabilities
  • NASL familySuSE Local Security Checks
    NASL idSUSE_KRB5-4851.NASL
    descriptionThis update fixes multiple vulnerabilties in krb5. It
    last seen2020-06-01
    modified2020-06-02
    plugin id29991
    published2008-01-16
    reporterThis script is Copyright (C) 2008-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/29991
    titleopenSUSE 10 Security Update : krb5 (krb5-4851)

Statements

contributorMark J Cox
lastmodified2007-12-14
organizationRed Hat
statementThis issue is not a vulnerability, for more information see http://marc.info/?m=119743235325151

References