CVE-2007-4743

2007-09-0622:17:00

CWE-119

[email protected]

web.nvd.nist.gov

mit

kerberos

krb5

buffer overflow

cve-2007-3999

rpcsec_gss

vulnerability

nvd

6.9 Medium

AI Score

Confidence

Low

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.922 High

EPSS

Percentile

98.9%

JSON

The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.

CPENameOperatorVersion
mit:kerberos_5mit kerberos 5eq1.4
mit:kerberos_5mit kerberos 5eq1.4.1
mit:kerberos_5mit kerberos 5eq1.4.2
mit:kerberos_5mit kerberos 5eq1.4.3
mit:kerberos_5mit kerberos 5eq1.4.4
mit:kerberos_5mit kerberos 5eq1.5
mit:kerberos_5mit kerberos 5eq1.5.1
mit:kerberos_5mit kerberos 5eq1.5.2
mit:kerberos_5mit kerberos 5eq1.5.3
mit:kerberos_5mit kerberos 5eq1.6

CPE	Name	Operator	Version
mit:kerberos_5	mit kerberos 5	eq	1.4
mit:kerberos_5	mit kerberos 5	eq	1.4.1
mit:kerberos_5	mit kerberos 5	eq	1.4.2
mit:kerberos_5	mit kerberos 5	eq	1.4.3
mit:kerberos_5	mit kerberos 5	eq	1.4.4
mit:kerberos_5	mit kerberos 5	eq	1.5
mit:kerberos_5	mit kerberos 5	eq	1.5.1
mit:kerberos_5	mit kerberos 5	eq	1.5.2
mit:kerberos_5	mit kerberos 5	eq	1.5.3
mit:kerberos_5	mit kerberos 5	eq	1.6