PT-2004-2137 · Mit+1 · Mit Kerberos 5+1

Published 2004-12-31 · Updated 2021-02-02 · CVE-2004-1189

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: MIT Kerberos 5 (krb5) versions up to 1.3.5

Description: The issue arises from the add to history function in svr principal.c in libkadm5srv for MIT Kerberos 5, which does not properly track the password policy's history count and the maximum number of keys during a password change. This can cause an array index out-of-bounds error, potentially allowing authenticated users to execute arbitrary code via a heap-based buffer overflow.

Recommendations: For MIT Kerberos 5 (krb5) versions up to 1.3.5, consider updating to a version that addresses this issue, as the current version may allow authenticated users to execute arbitrary code via a heap-based buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2004-1189

DSA-629-1

RHSA-2005:012

RHSA-2005:045

RHSA-2005_012

RHSA-2005_045

Affected Products

Mit Kerberos 5

Red Hat

References · 21

• https://security-tracker.debian.org/tracker/CVE-2004-1189 · Vendor Advisory
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-045.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1189 · Security Note
• https://osv.dev/vulnerability/CVE-2004-1189 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2004:156 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-012.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2004-1189 · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000917 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html · Vendor Advisory
• http://trustix.org/errata/2004/0069 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2005-012.html · Note
• https://redhat.com/security/data/cve/CVE-2004-1189.html · Note
• http://marc.info/?l=bugtraq&m=110548298407590&w=2 · Note