PT-2007-6899 · Mit · Mit Kerberos 5

Published 2007-12-06 · Updated 2024-06-15 · CVE-2007-5972

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 (krb5) version 1.5

Description A double free vulnerability exists in the krb5 def store mkey function, which has unknown impact and can be exploited through remote authenticated attack vectors. The vulnerability is related to the storage of the krb5kdc master key, requiring the attacker to have privileges to store this key.

Recommendations For MIT Kerberos 5 (krb5) version 1.5, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-5972

OPENSUSE-SU-2024:10899-1

Affected Products

Mit Kerberos 5

References · 38

• http://ubuntu.com/usn/USN-940-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-5972 · Vendor Advisory
• http://secunia.com/advisories/28636 · Vendor Advisory
• http://ubuntu.com/usn/usn-924-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5972 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-5972 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-5972 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10899-1 · Vendor Advisory
• http://novell.com/linux/security/advisories/suse_security_summary_report.html · Vendor Advisory
• https://suse.com/security/cve/CVE-2008-0947 · Note
• https://suse.com/security/cve/CVE-2018-5729 · Note
• http://bugs.gentoo.org/show_bug.cgi?id=199211 · Note
• https://suse.com/security/cve/CVE-2007-5972 · Note
• https://suse.com/security/cve/CVE-2017-11368 · Note
• https://suse.com/security/cve/CVE-2007-5894 · Note