CVE-2007-5939 The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact....
HighCVSS 10.0
EPSS 3.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username. NOTE: the vulnerability was originally reported for ftpd.c, but this is incorrect.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| heimdal | = 0.7.2 | No fix listed |
References
- bugs.gentoo.org
- 20071207 Heimdal ftpd uninitialized vulnerability mailing-list
- 44750 vdb-entry
- 1019057 vdb-entry
- MDKSA-2007:239 vendor-advisory
- 26758 vdb-entry
- Debian Security Tracker CVE-2007-5939 vendor-advisory