CVSS: 9.0EPSS: 94%CPEs: 6EXPL: 0CVE-2007-2798 – krb5 kadmind buffer overflow
https://notcve.org/view.php?id=CVE-2007-2798
Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal. Un desbordamiento de búfer en la región Stack de la memoria en la función rename_principal_2_svc en kadmind para MIT Kerberos versiones 1.5.3, 1.6.1, y otras versiones, permite a los usuarios autenticados remotos ejecutar código arbitrario por medio de una petición creada para renombrar un principal. • ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc http://docs.info.apple.com/article.html?artnum=306172 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=548 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html http://osvdb.org/36595 http://secunia.com/advisories/25800 htt • CWE-787: Out-of-bounds Write •
CVSS: 10.0EPSS: 96%CPEs: 6EXPL: 0CVE-2007-2442 – krb5 RPC library unitialized pointer free
https://notcve.org/view.php?id=CVE-2007-2442
The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup. La función gssrpc__svcauth_gssapi en la librería RPC de MIT Kerberos 5 (krb5) 1.6.1 y anteriores podría permitir a atacantes remotos ejecutar código de su elección mediante credenciales RPC de longitud cero, lo cual provoca que kadmind libere un puntero no inicializado durante la limpieza. • ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc http://docs.info.apple.com/article.html?artnum=306172 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html http://osvdb.org/36596 http://secunia.com/advisories/25800 http://secunia.com/advisories/25801 http://secunia.com/advisories/258 • CWE-824: Access of Uninitialized Pointer •
CVSS: 8.3EPSS: 96%CPEs: 6EXPL: 0CVE-2007-2443 – krb5 RPC library stack overflow
https://notcve.org/view.php?id=CVE-2007-2443
Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value. Error de entero sin signo en la función gssrpc__svcauth_unix de svc_auth_unix.c en la librería RPC de MIT Kerberos 5 (krb5) 1.6.1 y anteriores podría permitir a atacantes remotos ejecutar código de su elección mediante un valor de longitud negativa. • ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc http://docs.info.apple.com/article.html?artnum=306172 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427 http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html http://osvdb.org/36597 http://secunia.com/advisories/25800 http://secunia.com/advisories/25801 http://secunia.com/advisories/258 •
CVSS: 9.0EPSS: 15%CPEs: 6EXPL: 0CVE-2007-1216 – krb5 double free flaw
https://notcve.org/view.php?id=CVE-2007-1216
Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding". Una vulnerabilidad de Doble Liberación en la biblioteca GSS-API (lib/gssapi/krb5/k5unseal.c), como la utiliza el demonio de administración de Kerberos (kadmind) en MIT krb5 anterior a versión 1.6.1, cuando es usado con el método de autenticación proporcionado por la biblioteca RPC de RPCSEC_GSS, permite a los usuarios autenticados remotamente ejecutar código arbitrario y modificar la base de datos de claves de Kerberos mediante un mensaje con una "an invalid direction encoding". • ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc http://docs.info.apple.com/article.html?artnum=305391 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056923 http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html http://secunia.com/advisories/24706 http://secunia.com/advisories/24735 http://secunia.com/advisories/24736 http://secu • CWE-415: Double Free •
CVSS: 9.0EPSS: 96%CPEs: 6EXPL: 0CVE-2007-0957 – krb5_klog_syslog() stack buffer overflow
https://notcve.org/view.php?id=CVE-2007-0957
Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers. Desbordamiento de búfer en la función krb5_klog_syslog en la biblioteca kadm5, tal y como se usa en el demonio de administración de Kerberos (kadmind) y Key Distribution Center (KDC), en MIT krb5 versiones anteriores a 1permite a usuarios remotos autenticados ejecutar código de su elección y modificar la base de datos de contraseñas Kerberos mediante argumentos manipulados, posiblemente involucrando especificadores de formato de cadena concretos. • ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc http://docs.info.apple.com/article.html?artnum=305391 http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html http://secunia.com/advisories/24706 http://secunia.com/advisories/24735 http://secunia.com/advisories/24736 http://secunia.com/advisories/24740 http://secunia.com/advisories/24750 http://secunia.com/advisories/ • CWE-787: Out-of-bounds Write •