Vulnerability Description
Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mit | Kerberos 5 | < 1.6.1 |
| Debian | Debian Linux | 3.1 |
| Canonical | Ubuntu Linux | 5.10 |
Related Weaknesses (CWE)
References
- ftp://patches.sgi.com/support/free/security/advisories/20070401-01-P.ascBroken Link
- http://docs.info.apple.com/article.html?artnum=305391Broken Link
- http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.htmlMailing ListThird Party Advisory
- http://lists.suse.com/archive/suse-security-announce/2007-Apr/0001.htmlBroken Link
- http://secunia.com/advisories/24706Third Party Advisory
- http://secunia.com/advisories/24735Third Party Advisory
- http://secunia.com/advisories/24736Third Party Advisory
- http://secunia.com/advisories/24740Third Party Advisory
- http://secunia.com/advisories/24750Third Party Advisory
- http://secunia.com/advisories/24757Third Party Advisory
- http://secunia.com/advisories/24785Third Party Advisory
- http://secunia.com/advisories/24786Third Party Advisory
- http://secunia.com/advisories/24798Third Party Advisory
- http://secunia.com/advisories/24817Third Party Advisory
- http://secunia.com/advisories/24966Third Party Advisory
FAQ
What is CVE-2007-0957?
CVE-2007-0957 is a vulnerability with a CVSS score of 9.0 (HIGH). Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 a...
How severe is CVE-2007-0957?
CVE-2007-0957 has been rated HIGH with a CVSS base score of 9.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2007-0957?
Check the references section above for vendor advisories and patch information. Affected products include: Mit Kerberos 5, Debian Debian Linux, Canonical Ubuntu Linux.