CVE-2007-1216
- State
- Published
- Severity
- Not scored
- Published
- Apr 6, 2007
- Updated
- Aug 7, 2024
- Reserved
- Mar 2, 2007
Description
Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 23282vdb-entry
- ADV-2007-1218vdb-entry
- HPSBUX02217vendor-advisory
- 24966third-party-advisory
- 24706third-party-advisory
- oval:org.mitre.oval:def:11135vdb-entrysignature
- 24740third-party-advisory
- 1017852vdb-entry
- RHSA-2007:0095vendor-advisory
- 25388third-party-advisory
- 24786third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305391
- TA07-093Bthird-party-advisory
- 20070405 FLEA-2007-0008-1: krb5mailing-list
- DSA-1276vendor-advisory
- 24735third-party-advisory
- TA07-109Athird-party-advisory
- 24750third-party-advisory
- kerberos-kadmind-code-execution(33413)vdb-entry
- 24817third-party-advisory
- 24757third-party-advisory
- 20070403 MITKRB5-SA-2007-003: double-free vulnerability in kadmind (via GSS-API library) [CVE-2007-1216]mailing-list
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-003.txt
- ADV-2007-1916vdb-entry
- VU#419344third-party-advisory
- SUSE-SA:2007:025vendor-advisory
- 24785third-party-advisory
- MDKSA-2007:077vendor-advisory
- USN-449-1vendor-advisory
- APPLE-SA-2007-04-19vendor-advisory
- ADV-2007-1470vdb-entry
- 24736third-party-advisory
- 20070404 rPSA-2007-0063-1 krb5 krb5-server krb5-services krb5-test krb5-workstationmailing-list
- GLSA-200704-02vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.