Lucene search

[email protected]CVE-2008-0063

HistoryMar 19, 2008 - 10:44 a.m.

CVE-2008-0063

2008-03-1910:44:00

CWE-908

[email protected]

web.nvd.nist.gov

cve-2008-0063

kerberos 4

kdc

mit kerberos 5

krb5kdc

buffer overflow

remote attack

information disclosure

uninitialized stack values

security vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.017 Low

EPSS

Percentile

87.5%

JSON

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka “Uninitialized stack values.”

CPENameOperatorVersion
mit:kerberos_5mit kerberos 5le1.6.3
apple:mac_os_xapple mac os xlt10.4.11
apple:mac_os_xapple mac os xlt10.5.2
apple:mac_os_x_serverapple mac os x serverlt10.4.11
apple:mac_os_x_serverapple mac os x serverlt10.5.2
opensuse:opensuseopensuseeq10.2
opensuse:opensuseopensuseeq10.3
suse:linux_enterprise_software_development_kitsuse linux enterprise software development kiteq10
suse:linux_enterprise_serversuse linux enterprise servereq10
suse:linux_enterprise_desktopsuse linux enterprise desktopeq10

CPE	Name	Operator	Version
mit:kerberos_5	mit kerberos 5	le	1.6.3
apple:mac_os_x	apple mac os x	lt	10.4.11
apple:mac_os_x	apple mac os x	lt	10.5.2
apple:mac_os_x_server	apple mac os x server	lt	10.4.11
apple:mac_os_x_server	apple mac os x server	lt	10.5.2
opensuse:opensuse	opensuse	eq	10.2
opensuse:opensuse	opensuse	eq	10.3
suse:linux_enterprise_software_development_kit	suse linux enterprise software development kit	eq	10
suse:linux_enterprise_server	suse linux enterprise server	eq	10
suse:linux_enterprise_desktop	suse linux enterprise desktop	eq	10

Rows per page:

1-10 of 191

References

docs.info.apple.com/article.html?artnum=307562

lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html

secunia.com/advisories/29420

secunia.com/advisories/29423

secunia.com/advisories/29424

secunia.com/advisories/29428

secunia.com/advisories/29435

secunia.com/advisories/29438

secunia.com/advisories/29450

secunia.com/advisories/29451

secunia.com/advisories/29457

secunia.com/advisories/29462

secunia.com/advisories/29464

secunia.com/advisories/29516

secunia.com/advisories/29663

secunia.com/advisories/30535

support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022520.html

support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022542.html

web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-001.txt

wiki.rpath.com/Advisories:rPSA-2008-0112

wiki.rpath.com/wiki/Advisories:rPSA-2008-0112

www.debian.org/security/2008/dsa-1524

www.gentoo.org/security/en/glsa/glsa-200803-31.xml

www.mandriva.com/security/advisories?name=MDVSA-2008:069

www.mandriva.com/security/advisories?name=MDVSA-2008:070

www.mandriva.com/security/advisories?name=MDVSA-2008:071

www.redhat.com/support/errata/RHSA-2008-0164.html

www.redhat.com/support/errata/RHSA-2008-0180.html

www.redhat.com/support/errata/RHSA-2008-0181.html

www.redhat.com/support/errata/RHSA-2008-0182.html

www.securityfocus.com/archive/1/489761

www.securityfocus.com/archive/1/489883/100/0/threaded

www.securityfocus.com/archive/1/493080/100/0/threaded

www.securityfocus.com/bid/28303

www.securitytracker.com/id?1019627

www.ubuntu.com/usn/usn-587-1

www.vmware.com/security/advisories/VMSA-2008-0009.html

www.vupen.com/english/advisories/2008/0922/references

www.vupen.com/english/advisories/2008/0924/references

www.vupen.com/english/advisories/2008/1102/references

www.vupen.com/english/advisories/2008/1744

exchange.xforce.ibmcloud.com/vulnerabilities/41277

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8916

www.redhat.com/archives/fedora-package-announce/2008-March/msg00537.html

www.redhat.com/archives/fedora-package-announce/2008-March/msg00544.html

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

Low

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.017 Low

EPSS

Percentile

87.5%

JSON

Related for CVE-2008-0063

debiancve1 prion1 ubuntucve1 redhat4 cert1 securityvulns2 seebug1 nessus22 openvas34 centos4 osv1 oraclelinux3 debian2 ubuntu1 suse1 fedora2 gentoo1 vmware2