CVSS: 9.0EPSS: 96%CPEs: 6EXPL: 0CVE-2007-0957 – krb5_klog_syslog() stack buffer overflow
https://notcve.org/view.php?id=CVE-2007-0957
Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers. Desbordamiento de búfer en la función krb5_klog_syslog en la biblioteca kadm5, tal y como se usa en el demonio de administración de Kerberos (kadmind) y Key Distribution Center (KDC), en MIT krb5 versiones anteriores a 1permite a usuarios remotos autenticados ejecutar código de su elección y modificar la base de datos de contraseñas Kerberos mediante argumentos manipulados, posiblemente involucrando especificadores de formato de cadena concretos. • ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc http://docs.info.apple.com/article.html?artnum=305391 http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html http://secunia.com/advisories/24706 http://secunia.com/advisories/24735 http://secunia.com/advisories/24736 http://secunia.com/advisories/24740 http://secunia.com/advisories/24750 http://secunia.com/advisories/ • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 3%CPEs: 6EXPL: 0CVE-2007-0956 – Unauthorized access via krb5-telnet daemon
https://notcve.org/view.php?id=CVE-2007-0956
The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882. El demonio telnet (telnetd) en MIT krb5 anterior a 1.6.1 permite a atacantes remotos evitar la validación y ganar accesos al sistema a través de un nombre de usuario comenzando con el carácter '-', un asunto similar a CVE-2007-0882. • ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html http://secunia.com/advisories/24706 http://secunia.com/advisories/24735 http://secunia.com/advisories/24736 http://secunia.com/advisories/24740 http://secunia.com/advisories/24750 http://secunia.com/advisories/24755 http://secunia.com/advisories/24757 http://secunia.com/advisories/24785 http://secunia.com/advisories/24786 http:/&#x • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.3EPSS: 60%CPEs: 9EXPL: 0CVE-2006-6143
https://notcve.org/view.php?id=CVE-2006-6143
The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors. La librería RPC del Kerberos 5 1.4 hasta la 1.4.4 y de la 1.5 hasta la 1.5.1, como la usada en el demonio de administración del Kerberos (kadmind) y otros productos que utilizan esta librería, llama a un puntero de función sin inicializar en una memoria liberada, lo que permite a atacantes remotos provocar una denegación de servicio (caída) y la posibilidad de ejecutar código de su elección mediante vectores sin especificar. • http://docs.info.apple.com/article.html?artnum=305391 http://fedoranews.org/cms/node/2375 http://fedoranews.org/cms/node/2376 http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html http://osvdb.org/31281 http://secunia.com/advisories/23667 http://secunia.com/advisories/23696 http://secunia.com/advisories/23701 http://secunia.com/advisories/23706 http://secunia.com/advisories/23707&# • CWE-824: Access of Uninitialized Pointer •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2006-3084
https://notcve.org/view.php?id=CVE-2006-3084
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known whether an exploitable attack scenario exists for these issues. Los programas (1) ftpd y (2) ksu en MIT Kerberos 5 (krb5) actualizado a 1.5, y 1.4.X anterior a 1.4.4, no valida el código de retorno para las llamadas setuid, lo cual permite a un usuario local ganar privilegios provocando fallos del setuid para subir privilegios. NOTA: con en 20060808, no se conoce si existe un panorama explotable para estas ediciones. • ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt http://fedoranews.org/cms/node/2376 http://secunia.com/advisories/21402 http://secunia.com/advisories/21436 http://secunia.com/advisories/21439 http://secunia.com/advisories/21461 http://secunia.com/advisories/21467 http://secunia.com/advisories/21527 http://secunia.com/advisories/21613 http://secunia.com/advisories/23707 http://security.gentoo.org/glsa/glsa-200608-21.xml http://securitytracker.c • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2006-3083
https://notcve.org/view.php?id=CVE-2006-3083
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and (b) Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which allows local users to gain privileges by causing setuid to fail to drop privileges using attacks such as resource exhaustion. Las aplicaciones (1) krshd y (2) v4rcp en MIT Kerberos 5 (krb5) hasta 1.5, y 1.4.x anteriores a 1.4.4, cuando se ejecutan en Linux y AIX, no comprueban los códigos de retorno de llamadas 'setuid', lo que permite a usuarios locales fallar en soltar privilegios usando ataques como consumición de recursos. • ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt http://secunia.com/advisories/21402 http://secunia.com/advisories/21423 http://secunia.com/advisories/21436 http://secunia.com/advisories/21439 http://secunia.com/advisories/21441 http://secunia.com/advisories/21456 http://secunia.com/advisories/21461 http://secunia.com/advisories/21467 http://secunia.com/advisories/21527 http://secunia.com/advisories/21613 http://secunia.com/advisories/21847 http:& • CWE-399: Resource Management Errors •