PT-2008-1051 · Mit · Rpc Library+4
Jeff Altman
+1
·
Publicado
2008-03-18
·
Atualizado
2020-01-21
·
CVE-2008-0948
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
MIT Kerberos 5 (krb5) versions 1.2.2 through 1.3
Description
The issue is related to a buffer overflow in the RPC library used by libgssrpc and kadmind. This can be triggered when the system's unistd.h does not define the FD SETSIZE macro, allowing remote attackers to cause a denial of service or possibly execute arbitrary code by opening a large number of file descriptors. Multiple vulnerabilities in the krb5 package may lead to breaches in confidentiality, integrity, and availability of protected information, and these can be exploited remotely.
Recommendations
For versions 1.2.2 through 1.3, consider updating to a version after 1.3 to resolve the issue.
As a temporary workaround, consider restricting the number of open file descriptors to prevent the buffer overflow.
Avoid using the RPC library in sensitive operations until the issue is resolved.
Correção
Buffer Overflow
Improper Initialization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Mit Kerberos 5
Rpc Library
Kadmind
Krb5
Libgssrpc