Red Hat Security Advisory

RHSA-2008:0164

krb5 security and bugfix update

Released 2008-03-18 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Enterprise Linux (v. 5 server) krb5-1.6.1-17.el5_1.1, krb5-devel-1.6.1-17.el5_1.1, krb5-devel-1.6.1-17.el5_1.1.i386 +14
Red Hat Enterprise Linux Desktop (v. 5 client) krb5-1.6.1-17.el5_1.1, krb5-libs-1.6.1-17.el5_1.1, krb5-libs-1.6.1-17.el5_1.1.i386 +2
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) krb5-1.6.1-17.el5_1.1, krb5-devel-1.6.1-17.el5_1.1, krb5-devel-1.6.1-17.el5_1.1.i386 +2

Fixes 5 records

TI-2008-00910 CVE-2008-0947 · GHSA-w9c3-3cvm-x4wm

Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5)…

MEDIUM 54

Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.08832 Published 2008-03-19 Fixed CWE-119

TI-2008-00053 CVE-2008-0062 · GHSA-f6c2-j3p8-vxvv

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message…

MEDIUM 54

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10141 Published 2008-03-19 Fixed CWE-665

TI-2008-00054 CVE-2008-0063 · GHSA-67px-r9v8-hcfg

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the…

LOW 39

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03478 Published 2008-03-19 Fixed CWE-908

TI-2007-05709 CVE-2007-5971 · GHSA-mmmq-7mrq-vp86

Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in…

LOW 31

Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.0037 Published 2007-12-06 Fixed CWE-399

TI-2007-05642 CVE-2007-5901 · GHSA-qxh5-j4mp-pchg

Use-after-free vulnerability in the gss_indicate_mechs function in…

LOW 31

Use-after-free vulnerability in the gss_indicate_mechs function in lib/gssapi/mechglue/g_initialize.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.

CVSS 2.0MEDIUM 6.9 Local No auth Interaction — EPSS 0.00471 Published 2007-12-06 Fixed CWE-399