CVE-2007-4743
En bref
- Source
- NVD
- EPSS
- EPSS 4.61 % · centile 92 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
The original patch for CVE-2007-3999 in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.
Faiblesses (CWE)
- CWE-119 — Opération hors des limites d'un tampon mémoire
Références
- http://www.debian.org/security/2007/dsa-1387
- http://secunia.com/advisories/26699
- http://www.novell.com/linux/security/advisories/2007_19_sr.html
- http://www.redhat.com/support/errata/RHSA-2007-0892.html
- https://issues.rpath.com/browse/RPL-1696
- http://www.securityfocus.com/bid/26444
- http://www.ubuntu.com/usn/usn-511-2
- http://www.securityfocus.com/archive/1/478794/100/0/threaded
- http://secunia.com/advisories/26987
- http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
- http://docs.info.apple.com/article.html?artnum=307041
- http://www.securityfocus.com/archive/1/478748/100/0/threaded
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10239
- http://article.gmane.org/gmane.comp.encryption.kerberos.announce/86
- http://www.vupen.com/english/advisories/2007/3868
- http://secunia.com/advisories/27643
- http://www.us-cert.gov/cas/techalerts/TA07-319A.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | HIGH 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2007-4724
- GCVE · GCVE-0-2007-4743
Avis du CERT-FR
- CERTA-2007-AVI-499 — Multiples vulnérabilités du système Mac OS X · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:mit:kerberos_5:1.4:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.4.1:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.4.2:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.4.3:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.4.4:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.5:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.5.1:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.5.2:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.5.3:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.6:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.6.1:*:*:*:*:*:*:*cpe:2.3:a:mit:kerberos_5:1.6.2:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |