CVE-2007-0957
En bref
- Source
- NVD
- EPSS
- EPSS 10.33 % · centile 96 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Rechercher sur…
Description
Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.
Faiblesses (CWE)
- CWE-787 — Écriture hors limites
Références
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10757
- http://www.vupen.com/english/advisories/2007/1218
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-002-syslog.txt
- http://www.securityfocus.com/archive/1/464592/100/0/threaded
- http://secunia.com/advisories/24966
- http://secunia.com/advisories/24706
- http://secunia.com/advisories/24798
- http://secunia.com/advisories/24740
- http://www.redhat.com/support/errata/RHSA-2007-0095.html
- http://www.vupen.com/english/advisories/2007/1983
- http://secunia.com/advisories/24786
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102930-1
- http://docs.info.apple.com/article.html?artnum=305391
- http://www.us-cert.gov/cas/techalerts/TA07-093B.html
- http://www.securityfocus.com/archive/1/464814/30/7170/threaded
- http://www.debian.org/security/2007/dsa-1276
- http://secunia.com/advisories/24735
- http://www.securityfocus.com/bid/23285
- http://www.us-cert.gov/cas/techalerts/TA07-109A.html
- http://secunia.com/advisories/24750
- http://www.vupen.com/english/advisories/2007/1250
- http://secunia.com/advisories/24817
- http://secunia.com/advisories/24757
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33411
- http://www.kb.cert.org/vuls/id/704024
- http://www.securitytracker.com/id?1017849
- http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.html
- http://secunia.com/advisories/24785
- http://secunia.com/advisories/25464
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:077
- http://www.ubuntu.com/usn/usn-449-1
- http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
- http://www.vupen.com/english/advisories/2007/1470
- http://secunia.com/advisories/24736
- http://www.securityfocus.com/archive/1/464666/100/0/threaded
- http://security.gentoo.org/glsa/glsa-200704-02.xml
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2007-0951
- GCVE · GCVE-0-2007-0957
Avis du CERT-FR
- CERTA-2007-AVI-185 — Multiples vulnérabilités dans Apple MacOS X · cert.ssi.gouv.fr
- CERTA-2007-AVI-158 — Multiples vulnérabilités de Kerberos · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*< 1.6.1cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:5.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |