CVSS: 9.0EPSS: 96%CPEs: 6EXPL: 0CVE-2007-0957 – krb5_klog_syslog() stack buffer overflow
https://notcve.org/view.php?id=CVE-2007-0957
Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers. Desbordamiento de búfer en la función krb5_klog_syslog en la biblioteca kadm5, tal y como se usa en el demonio de administración de Kerberos (kadmind) y Key Distribution Center (KDC), en MIT krb5 versiones anteriores a 1permite a usuarios remotos autenticados ejecutar código de su elección y modificar la base de datos de contraseñas Kerberos mediante argumentos manipulados, posiblemente involucrando especificadores de formato de cadena concretos. • ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc http://docs.info.apple.com/article.html?artnum=305391 http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html http://secunia.com/advisories/24706 http://secunia.com/advisories/24735 http://secunia.com/advisories/24736 http://secunia.com/advisories/24740 http://secunia.com/advisories/24750 http://secunia.com/advisories/ • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 0CVE-2007-0956 – Unauthorized access via krb5-telnet daemon
https://notcve.org/view.php?id=CVE-2007-0956
The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882. El demonio telnet (telnetd) en MIT krb5 anterior a 1.6.1 permite a atacantes remotos evitar la validación y ganar accesos al sistema a través de un nombre de usuario comenzando con el carácter '-', un asunto similar a CVE-2007-0882. • ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html http://secunia.com/advisories/24706 http://secunia.com/advisories/24735 http://secunia.com/advisories/24736 http://secunia.com/advisories/24740 http://secunia.com/advisories/24750 http://secunia.com/advisories/24755 http://secunia.com/advisories/24757 http://secunia.com/advisories/24785 http://secunia.com/advisories/24786 http:/&#x • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 32%CPEs: 5EXPL: 0CVE-2005-1689
https://notcve.org/view.php?id=CVE-2005-1689
Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions. Vulnerabilidad de doble liberación de memoria en la función krb5_recvauth en MIT Kerberos 5 (krb5) 1.4.1 y anteriores permite que atacantes remotos ejecuten código arbitrario mediante ciertas condiciones de error. • ftp://patches.sgi.com/support/free/security/advisories/20050703-01-U.asc http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000993 http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html http://marc.info/?l=bugtraq&m=112119974704542&w=2 http://secunia.com/advisories/16041 http://secunia.com/advisories/17135 http://secunia.com/advisories/17899 http://secunia.com/advisories/22090 • CWE-415: Double Free •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2004-1189
https://notcve.org/view.php?id=CVE-2004-1189
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000917 http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html http://marc.info/?l=bugtraq&m=110358420909358&w=2 http://marc.info/?l=bugtraq&m=110548298407590&w=2 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt http://www.mandriva.com/security/advisories?name=MDKSA-2004:156 http://www.redhat.com/support • CWE-787: Out-of-bounds Write •
CVSS: 5.0EPSS: 21%CPEs: 13EXPL: 0CVE-2004-0644
https://notcve.org/view.php?id=CVE-2004-0644
The asn1buf_skiptail function in the ASN.1 decoder library for MIT Kerberos 5 (krb5) 1.2.2 through 1.3.4 allows remote attackers to cause a denial of service (infinite loop) via a certain BER encoding. La función asn1buf_skiptail de la librería de decodificación de ASN.1 de MIT Kerberos 5 (krb5) 1.2.2 a 1.3.4 permite a atacantes remotos causar una denegación de servicio (bucle infinito) mediante cierta codificación BER. • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000860 http://marc.info/?l=bugtraq&m=109508872524753&w=2 http://rhn.redhat.com/errata/RHSA-2004-350.html http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-003-asn1.txt http://www.debian.org/security/2004/dsa-543 http://www.gentoo.org/security/en/glsa/glsa-200409-09.xml http://www.kb.cert.org/vuls/id/550464 http://www.securityfocus.com/bid/11079 http://www.trustix.net/errata/2004/0045 •