PT-2007-1084 · Mit+2 · Kadmind+5

Published 2007-04-03 · Updated 2024-06-15 · CVE-2007-1216

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: MIT krb5 versions prior to 1.6.1

Description: The issue is related to a double free vulnerability in the GSS-API library, specifically in the k5unseal.c file, which is used by the Kerberos administration daemon (kadmind) when the authentication method provided by the RPCSEC GSS RPC library is utilized. This vulnerability allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an invalid direction encoding.

Recommendations: For MIT krb5 versions prior to 1.6.1, update to version 1.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the kadmind daemon until a patch is applied.

Fix

Double Free

Missing Authentication

Weakness Enumeration

CWE-415

CWE-306

Related Identifiers

BDU:2015-09557

CVE-2007-1216

DSA-1276-1

HPSBUX02217

OPENSUSE-SU-2024:10899-1

RHSA-2007:0095

RHSA-2007_0095

Affected Products

Gssapi

Hp-Ux

Mit-Krb5

Rpcsec Gss

Red Hat

Kadmind

References · 68

• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1216 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0095.html · Vendor Advisory
• http://ubuntu.com/usn/usn-449-1 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200704-02.xml · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.asc · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01056923 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10899-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1216 · Security Note
• http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-003.txt · Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html · Vendor Advisory
• http://debian.org/security/2007/dsa-1276 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-1216 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1216 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09557 · Security Note
• http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html · Vendor Advisory