CVE-2002-1235
- State
- Published
- Severity
- Not scored
- Published
- Oct 25, 2002
- Updated
- Aug 8, 2024
- Reserved
- Oct 24, 2002
Description
The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 20021026 Updated: MITKRB5-SA-2002-002: Buffer overflow in kadmind4mailing-list
- MDKSA-2002:073vendor-advisory
- 20021027 Re: Buffer overflow in kadmind4mailing-list
- 20021023 MITKRB5-SA-2002-002: Buffer overflow in kadmind4mailing-list
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-002-kadm4.txt
- DSA-185vendor-advisory
- http://web.mit.edu/kerberos/www/advisories/2002-002-kadm4_attacksig.txt
- 20021028 GLSA: krb5mailing-list
- DSA-183vendor-advisory
- kerberos-kadmind-bo(10430)vdb-entry
- CLA-2002:534vendor-advisory
- CA-2002-29third-party-advisory
- DSA-184vendor-advisory
- http://www.pdc.kth.se/heimdal/
- VU#875073third-party-advisory
- RHSA-2002:242vendor-advisory
- 20021027 KRB5-SORCERER2002-10-27 Security Updatemailing-list
- 6024vdb-entry
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.