PT-2007-6831 · Mit · Mit Kerberos 5

CVE-2007-5894 · Publicado 2007-12-06 · Atualizado 2024-08-07

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (krb5) (affected versions not specified)

Description The issue concerns the reply function in ftpd.c in the gssftp ftpd, where the length variable may not be initialized under specific conditions related to the auth type value. This could potentially be exploited through remote authenticated attack vectors. However, the vendor disputes this issue, stating that the condition for the uninitialized variable cannot occur in the unmodified source code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2007-5894

OPENSUSE-SU-2024:10899-1

Produtos afetados

Mit Kerberos 5

Referências · 37

• https://osv.dev/vulnerability/CVE-2007-5894 · Aviso do Fabricante
• http://bugs.gentoo.org/show_bug.cgi?id=199205 · Nota
• https://suse.com/security/cve/CVE-2008-0947 · Nota
• https://suse.com/security/cve/CVE-2008-0062 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-5894 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-5729 · Nota
• https://suse.com/security/cve/CVE-2007-5972 · Nota
• http://secunia.com/advisories/29457 · Aviso do Fabricante
• http://wiki.rpath.com/Advisories:rPSA-2008-0112 · Nota
• https://suse.com/security/cve/CVE-2017-11368 · Nota
• https://suse.com/security/cve/CVE-2007-5894 · Nota
• https://suse.com/security/cve/CVE-2007-5902 · Nota
• https://suse.com/security/cve/CVE-2021-36222 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10899-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2007-3999 · Nota