CVE-2005-1689

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.

Vulnerabilidad de doble liberación de memoria en la función krb5_recvauth en MIT Kerberos 5 (krb5) 1.4.1 y anteriores permite que atacantes remotos ejecuten código arbitrario mediante ciertas condiciones de error.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2005-05-24 CVE Reserved
2005-07-13 CVE Published
2024-06-23 EPSS Updated
2024-08-07 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-415: Double Free

CAPEC

References (29)

URL	Tag	Source
http://securitytracker.com/id?1014461	Broken Link
http://www.securityfocus.com/bid/14239	Broken Link
http://www.vupen.com/english/advisories/2005/1066	Broken Link
http://www.vupen.com/english/advisories/2006/3776	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/21055	Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9819	Broken Link

URL	Date	SRC

URL	Date	SRC
http://marc.info/?l=bugtraq&m=112119974704542&w=2	2024-02-02
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-003-recvauth.txt	2024-02-02
http://www.debian.org/security/2005/dsa-757	2024-02-02
http://www.kb.cert.org/vuls/id/623332	2024-02-02

URL	Date	SRC
ftp://patches.sgi.com/support/free/security/advisories/20050703-01-U.asc	2024-02-02
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000993	2024-02-02
http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html	2024-02-02
http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html	2024-02-02
http://secunia.com/advisories/16041	2024-02-02
http://secunia.com/advisories/17135	2024-02-02
http://secunia.com/advisories/17899	2024-02-02
http://secunia.com/advisories/22090	2024-02-02
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101810-1	2024-02-02
http://www.gentoo.org/security/en/glsa/glsa-200507-11.xml	2024-02-02
http://www.novell.com/linux/security/advisories/2005_17_sr.html	2024-02-02
http://www.redhat.com/support/errata/RHSA-2005-562.html	2024-02-02
http://www.redhat.com/support/errata/RHSA-2005-567.html	2024-02-02
http://www.securityfocus.com/archive/1/446940/100/0/threaded	2024-02-02
http://www.trustix.org/errata/2005/0036	2024-02-02
http://www.turbolinux.com/security/2005/TLSA-2005-78.txt	2024-02-02
https://usn.ubuntu.com/224-1	2024-02-02
https://access.redhat.com/security/cve/CVE-2005-1689	2005-07-12
https://bugzilla.redhat.com/show_bug.cgi?id=1617659	2005-07-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Mit Search vendor "Mit"		Kerberos 5 Search vendor "Mit" for product "Kerberos 5"				<= 1.4.1 Search vendor "Mit" for product "Kerberos 5" and version " <= 1.4.1"		-		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				< 10.4.2 Search vendor "Apple" for product "Mac Os X" and version " < 10.4.2"		-		Affected
Apple Search vendor "Apple"		Mac Os X Server Search vendor "Apple" for product "Mac Os X Server"				< 10.4.2 Search vendor "Apple" for product "Mac Os X Server" and version " < 10.4.2"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				3.0 Search vendor "Debian" for product "Debian Linux" and version "3.0"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				3.1 Search vendor "Debian" for product "Debian Linux" and version "3.1"		-		Affected