Düşük
CVE-2007-5894: Kerberos 5: güvenlik açığı
Açıklama (NVD)
The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.
Özet bilgiler
- Ürün
- Mit Kerberos 5
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| mit-kerberos-5 | — | — | 1.6.4 |
Kaynaklar
- NVD kaydı
- bugs.gentoo.org
- osvdb.org
- seclists.org
- seclists.org
- secunia.com
- secunia.com
- wiki.rpath.com
- wiki.rpath.com
- www.novell.com
- www.securityfocus.com
- www.securityfocus.com
- issues.rpath.com
- bugs.gentoo.org
- osvdb.org
- seclists.org
- seclists.org
- secunia.com
- secunia.com
- wiki.rpath.com
- wiki.rpath.com
- www.novell.com
- www.securityfocus.com
- www.securityfocus.com
- issues.rpath.com