Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2007-4743

Overview

Vulnerability Score 10.0 10.0
CVE Id CVE-2007-4743
Last Modified 07 Mar 2011 09:59:06
Published 06 Sep 2007 06:17:00
Confidentiality Impact COMPLETE COMPLETE
Integrity Impact COMPLETE COMPLETE
Availability Impact COMPLETE COMPLETE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE

CVE-2007-4743

Summary

The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.

Vulnerable Systems

Application

  • Mit Kerberos 5-1.4

  • Mit Kerberos 5-1.4.1

  • Mit Kerberos 5-1.4.2

  • Mit Kerberos 5-1.4.3

  • Mit Kerberos 5-1.4.4

  • Mit Kerberos 5-1.5

  • Mit Kerberos 5-1.5.1

  • Mit Kerberos 5-1.5.2

  • Mit Kerberos 5-1.5.3

  • Mit Kerberos 5-1.6

  • Mit Kerberos 5-1.6.1

  • Mit Kerberos 5-1.6.2


References

CERT - TA07-319A

CONFIRM - http://article.gmane.org/gmane.comp.encryption.kerberos.announce/86

VUPEN - ADV-2007-3868

CONFIRM - https://issues.rpath.com/browse/RPL-1696

UBUNTU - USN-511-2

BID - 26444

BUGTRAQ - 20070907 FLEA-2007-0050-1 krb5 krb5-workstation

BUGTRAQ - 20070906 rPSA-2007-0179-1 krb5 krb5-server krb5-services krb5-test krb5-workstation

REDHAT - RHSA-2007:0892

SUSE - SUSE-SR:2007:019

DEBIAN - DSA-1387

SECUNIA - 27643

SECUNIA - 26987

SECUNIA - 26699

APPLE - APPLE-SA-2007-11-14

CONFIRM - http://docs.info.apple.com/article.html?artnum=307041

Related Patches

Apple 2007-11-14 Mac OS X 10.4.11 Update (PPC)

Apple 2007-11-14 Mac OS X 10.4.11 Combo Update (PPC)

Apple 2007-11-14 Mac OS X Server 10.4.11 Combo Update (PPC)

Apple 2007-11-14 Mac OS X Server 10.4.11 Update (PPC)


Last Updated: 27 May 2016 10:45:57