Red Hat Security AdvisoryRHSA-2008:0180
krb5 security update
Released 2008-03-18 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AS version 4 krb5-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1.i386 +14
- Red Hat Enterprise Linux Desktop version 4 krb5-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1.i386 +6
- Red Hat Enterprise Linux ES version 4 krb5-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1.i386 +10
- Red Hat Enterprise Linux WS version 4 krb5-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1, krb5-devel-1.3.4-54.el4_6.1.i386 +10
Fixes 3 records
Priority MEDIUM 54
KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.10141 · Published 2008-03-19 · Fixed CWE-665
Priority LOW 39
The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03478 · Published 2008-03-19 · Fixed CWE-908
Priority LOW 31
Double free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.
CVSS 2.0MEDIUM 6.9· Local · No auth · Interaction — · EPSS 0.0037 · Published 2007-12-06 · Fixed CWE-399
