PT-2007-6872 · Heimdal · Heimdal

Published 2007-12-06 · Updated 2008-11-15 · CVE-2007-5939

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Heimdal version 0.7.2

Description The issue is related to the gss userok function in Heimdal, which does not allocate memory for the ticketfile pointer before calling free. This allows remote attackers to have an unknown impact via an invalid username.

Recommendations For Heimdal version 0.7.2, update to a newer version that contains a fix for this issue.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-5939

Affected Products

Heimdal

References · 7

• http://mandriva.com/security/advisories?name=MDKSA-2007:239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5939 · Security Note
• http://osvdb.org/44750 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=199207 · Note
• http://marc.info/?l=full-disclosure&m=119704362903699&w=2 · Note
• http://securitytracker.com/id?1019057 · Note
• http://securityfocus.com/bid/26758 · Note