CVE-2004-0523 Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
HighCVSS 10.0
EPSS 11.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos | = 1.0 | No fix listed |
| mit kerberos | = 1.0.8 | No fix listed |
| mit kerberos | = 1.2.2.beta1 | No fix listed |
| mit kerberos 5 | = 1.0 | No fix listed |
| mit kerberos 5 | = 1.0.6 | No fix listed |
| mit kerberos 5 | = 1.1 | No fix listed |
| mit kerberos 5 | = 1.1.1 | No fix listed |
| mit kerberos 5 | = 1.2 | No fix listed |
| mit kerberos 5 | = 1.2-beta1 | No fix listed |
| mit kerberos 5 | = 1.2-beta2 | No fix listed |
| mit kerberos 5 | = 1.2.1 | No fix listed |
| mit kerberos 5 | = 1.2.2 | No fix listed |
| mit kerberos 5 | = 1.2.3 | No fix listed |
| mit kerberos 5 | = 1.2.4 | No fix listed |
| mit kerberos 5 | = 1.2.5 | No fix listed |
| mit kerberos 5 | = 1.2.6 | No fix listed |
| mit kerberos 5 | = 1.2.7 | No fix listed |
| mit kerberos 5 | = 1.3 | No fix listed |
| mit kerberos 5 | = 1.3-alpha1 | No fix listed |
| mit kerberos 5 | = 1.3.3 | No fix listed |
| sgi propack | = 2.4 | No fix listed |
| sgi propack | = 3.0 | No fix listed |
| sun seam | = 1.0 | No fix listed |
| sun seam | = 1.0.1 | No fix listed |
| sun seam | = 1.0.2 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| tinysofa enterprise server | = 1.0 | No fix listed |
| tinysofa enterprise server | = 1.0_u1 | No fix listed |
| sun solaris | = 8.0 | No fix listed |
| sun solaris | = 9.0 | No fix listed |
| sunos | = 5.8 | No fix listed |
| debian/krb5(Debian:12) | < 1.3.3-2 | 1.3.3-2 |
| debian/krb5(Debian:13) | < 1.3.3-2 | 1.3.3-2 |
| debian/krb5(Debian:14) | < 1.3.3-2 | 1.3.3-2 |
References
- CLA-2004:860 vendor-advisory
- FEDORA-2004-149 vendor-advisory
- 20040601 MITKRB5-SA-2004-001: buffer overflows in krb5_aname_to_localname mailing-list
- 20040602 TSSA-2004-009 - kerberos5 mailing-list
- 2004-0032 vendor-advisory
- 101512 vendor-advisory
- DSA-520 patch vendor-advisory
- GLSA-200406-21 vendor-advisory
- VU#686862 third-party-advisory us-government-resource
- MDKSA-2004:056 vendor-advisory
- RHSA-2004:236 vendor-advisory
- 10448 vdb-entry
- Kerberos-krb5anametolocalname-bo(16268) vdb-entry
- oval:org.mitre.oval:def:10295 signature vdb-entry
- oval:org.mitre.oval:def:2002 signature vdb-entry
- oval:org.mitre.oval:def:724 signature vdb-entry
- oval:org.mitre.oval:def:991 signature vdb-entry
- Debian Security Tracker CVE-2004-0523 vendor-advisory