CVE-2007-3999
- State
- Published
- Severity
- Not scored
- Published
- Sep 5, 2007
- Updated
- Aug 7, 2024
- Reserved
- Jul 25, 2007
Description
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- GLSA-200709-01vendor-advisory
- FEDORA-2007-2017vendor-advisory
- 20070912 ZDI-07-052: Multiple Kerberos Implementations Authentication Context Stack Overflow Vulnerabilitymailing-list
- 26713third-party-advisory
- 26822third-party-advisory
- 27043third-party-advisory
- ADV-2008-0803vdb-entry
- 26699third-party-advisory
- SUSE-SR:2007:019vendor-advisory
- ADV-2007-3060vdb-entry
- 26680third-party-advisory
- 26783third-party-advisory
- 1018647vdb-entry
- 26444vdb-entry
- ADV-2007-3051vdb-entry
- 27756third-party-advisory
- 26684third-party-advisory
- DSA-1367vendor-advisory
- RHSA-2007:0951vendor-advisory
- 26728third-party-advisory
- 26700third-party-advisory
- oval:org.mitre.oval:def:3162vdb-entrysignature
- https://bugzilla.redhat.com/show_bug.cgi?id=250973
- 26987third-party-advisory
- 2007-0026vendor-advisory
- 26676third-party-advisory
- oval:org.mitre.oval:def:9379vdb-entrysignature
- APPLE-SA-2007-11-14vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307041
- USN-511-1vendor-advisory
- 27081third-party-advisory
- 20070906 rPSA-2007-0179-1 krb5 krb5-server krb5-services krb5-test krb5-workstationmailing-list
- SUSE-SR:2007:024vendor-advisory
- 29270third-party-advisory
- FEDORA-2008-1017vendor-advisory
- 201319vendor-advisory
- ADV-2007-3868vdb-entry
- GLSA-200710-01vendor-advisory
- RHSA-2007:0913vendor-advisory
- [security-announce] 20070906 rPSA-2007-0179-2 krb5 krb5-server krb5-services krb5-test krb5-workstationmailing-list
- DSA-1368vendor-advisory
- RHSA-2007:0858vendor-advisory
- MDKSA-2007:181vendor-advisory
- http://www.zerodayinitiative.com/advisories/ZDI-07-052.html
- 26691third-party-advisory
- 26896third-party-advisory
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt
- 26697third-party-advisory
- 27146third-party-advisory
- VU#883632third-party-advisory
- 27643third-party-advisory
- ADV-2007-3052vdb-entry
- kerberos-rpcsecgss-bo(36437)vdb-entry
- 25534vdb-entry
- TA07-319Athird-party-advisory
- 26705third-party-advisory
- 3092third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-396.htm
- 26792third-party-advisory
- 29247third-party-advisory
- 103060vendor-advisory
- MDKSA-2007:174vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.