PT-2004-2137 · Mit+1 · Mit Kerberos 5+1
Publicado
2004-12-31
·
Atualizado
2021-02-02
·
CVE-2004-1189
CVSS v2.0
7.2
Alta
| Vetor | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
MIT Kerberos 5 (krb5) versions up to 1.3.5
Description:
The issue arises from the
add to history function in svr principal.c in libkadm5srv for MIT Kerberos 5, which does not properly track the password policy's history count and the maximum number of keys during a password change. This can cause an array index out-of-bounds error, potentially allowing authenticated users to execute arbitrary code via a heap-based buffer overflow.Recommendations:
For MIT Kerberos 5 (krb5) versions up to 1.3.5, consider updating to a version that addresses this issue, as the current version may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Memory Corruption
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Mit Kerberos 5
Red Hat