CVE-2007-2798 Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafte...
HighCVSS 9.0
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos 5 | <= 1.6.1 | No fix listed |
| Canonical Ubuntu Linux | = 6.06 | No fix listed |
| Canonical Ubuntu Linux | = 6.10 | No fix listed |
| Canonical Ubuntu Linux | = 7.04 | No fix listed |
| debian linux | = 3.1 | No fix listed |
| debian linux | = 4.0 | No fix listed |
| debian/krb5(Debian:12) | < 1.6.dfsg.1-5 | 1.6.dfsg.1-5 |
| debian/krb5(Debian:13) | < 1.6.dfsg.1-5 | 1.6.dfsg.1-5 |
| debian/krb5(Debian:14) | < 1.6.dfsg.1-5 | 1.6.dfsg.1-5 |
References
- docs.info.apple.com broken-link
- SSRT100107 broken-link vendor-advisory
- 20070626 Multiple Vendor Kerberos kadmind Rename Principal Buffer Overflow Vulnerability broken-link third-party-advisory
- APPLE-SA-2007-07-31 mailing-list third-party-advisory vendor-advisory
- 20070920 VMSA-2007-0006 Critical security updates for all supported versions of VMware ESX Server, VMware Server, VMware Workstation, VMware ACE, and VMware Player mailing-list third-party-advisory
- 36595 broken-link vdb-entry
- 25800 third-party-advisory
- 25801 third-party-advisory
- 25814 third-party-advisory
- 25821 third-party-advisory
- 25870 third-party-advisory
- 25875 third-party-advisory
- 25888 third-party-advisory
- 25890 third-party-advisory
- 25894 third-party-advisory
- 25911 third-party-advisory
- 26033 third-party-advisory
- 26228 third-party-advisory
- 26235 third-party-advisory
- 26909 third-party-advisory
- 27706 third-party-advisory
- 40346 third-party-advisory
- GLSA-200707-11 third-party-advisory vendor-advisory
- 102985 broken-link vendor-advisory
- web.mit.edu patch vendor-advisory
- DSA-1323 third-party-advisory vendor-advisory
- VU#554257 patch third-party-advisory us-government-resource
- MDKSA-2007:137 third-party-advisory vendor-advisory
- SUSE-SA:2007:038 broken-link vendor-advisory
- RHSA-2007:0384 third-party-advisory vendor-advisory
- RHSA-2007:0562 third-party-advisory vendor-advisory
- 20070626 MITKRB5-SA-2007-005: kadmind vulnerable to buffer overflow mailing-list third-party-advisory vdb-entry
- 20070628 FLEA-2007-0029-1: krb5 krb5-workstation mailing-list third-party-advisory vdb-entry
- 20070629 TSLSA-2007-0021 - kerberos5 mailing-list third-party-advisory vdb-entry
- 24653 third-party-advisory vdb-entry
- 25159 third-party-advisory vdb-entry
- 1018295 third-party-advisory vdb-entry
- 2007-0021 broken-link vendor-advisory
- USN-477-1 third-party-advisory vendor-advisory
- TA07-177A third-party-advisory us-government-resource
- ADV-2007-2337 third-party-advisory vdb-entry
- ADV-2007-2370 third-party-advisory vdb-entry
- ADV-2007-2491 third-party-advisory vdb-entry
- ADV-2007-2732 third-party-advisory vdb-entry
- ADV-2007-3229 third-party-advisory vdb-entry
- ADV-2010-1574 third-party-advisory vdb-entry
- kerberos-renameprincipal2svc-bo(35080) third-party-advisory vdb-entry
- issues.rpath.com broken-link
- oval:org.mitre.oval:def:1726 broken-link signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:7550 broken-link signature third-party-advisory vdb-entry
- oval:org.mitre.oval:def:9996 signature third-party-advisory vdb-entry
- secure-support.novell.com broken-link
- Debian Security Tracker CVE-2007-2798 vendor-advisory
- bugs.debian.org issue-tracking