CVE-2007-4000

The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.

CVSS v2.0 8.5 HIGH

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=250976	Issue Tracking
http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt	Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2007-0858.html	Third Party Advisory
https://issues.rpath.com/browse/RPL-1696	Broken Link
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00087.html	Mailing List
http://www.gentoo.org/security/en/glsa/glsa-200709-01.xml	Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2007:174	Broken Link
http://www.novell.com/linux/security/advisories/2007_19_sr.html	Broken Link
http://www.kb.cert.org/vuls/id/377544	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/25533	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1018647	Broken Link Third Party Advisory VDB Entry
http://secunia.com/advisories/26680	Broken Link
http://secunia.com/advisories/26728	Broken Link
http://secunia.com/advisories/26676	Broken Link
http://secunia.com/advisories/26700	Broken Link
http://secunia.com/advisories/26783	Broken Link
http://secunia.com/advisories/26987	Broken Link
http://securityreason.com/securityalert/3092	Broken Link
http://www.vupen.com/english/advisories/2007/3051	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/36438	Broken Link VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9278	Broken Link
http://www.securityfocus.com/archive/1/478794/100/0/threaded	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*

History

09 Feb 2024, 03:24

Type	Values Removed	Values Added
References	~~(MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:174 -~~	(MANDRIVA) http://www.mandriva.com/security/advisories?name=MDKSA-2007:174 - Broken Link
References	~~(SREASON) http://securityreason.com/securityalert/3092 -~~	(SREASON) http://securityreason.com/securityalert/3092 - Broken Link
References	~~(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=250976 -~~	(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=250976 - Issue Tracking
References	~~(GENTOO) http://www.gentoo.org/security/en/glsa/glsa-200709-01.xml -~~	(GENTOO) http://www.gentoo.org/security/en/glsa/glsa-200709-01.xml - Third Party Advisory
References	~~(REDHAT) http://www.redhat.com/support/errata/RHSA-2007-0858.html -~~	(REDHAT) http://www.redhat.com/support/errata/RHSA-2007-0858.html - Third Party Advisory
References	~~(OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9278 -~~	(OVAL) https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9278 - Broken Link
References	~~(SECUNIA) http://secunia.com/advisories/26700 -~~	(SECUNIA) http://secunia.com/advisories/26700 - Broken Link
References	~~(SECUNIA) http://secunia.com/advisories/26676 -~~	(SECUNIA) http://secunia.com/advisories/26676 - Broken Link
References	~~(SECTRACK) http://www.securitytracker.com/id?1018647 -~~	(SECTRACK) http://www.securitytracker.com/id?1018647 - Broken Link, Third Party Advisory, VDB Entry
References	~~(CERT-VN) http://www.kb.cert.org/vuls/id/377544 - US Government Resource~~	(CERT-VN) http://www.kb.cert.org/vuls/id/377544 - Third Party Advisory, US Government Resource
References	~~(VUPEN) http://www.vupen.com/english/advisories/2007/3051 -~~	(VUPEN) http://www.vupen.com/english/advisories/2007/3051 - Broken Link
References	~~(SECUNIA) http://secunia.com/advisories/26728 -~~	(SECUNIA) http://secunia.com/advisories/26728 - Broken Link
References	~~(SECUNIA) http://secunia.com/advisories/26783 -~~	(SECUNIA) http://secunia.com/advisories/26783 - Broken Link
References	~~(SECUNIA) http://secunia.com/advisories/26987 -~~	(SECUNIA) http://secunia.com/advisories/26987 - Broken Link
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/36438 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/36438 - Broken Link, VDB Entry
References	~~(SECUNIA) http://secunia.com/advisories/26680 -~~	(SECUNIA) http://secunia.com/advisories/26680 - Broken Link
References	~~(SUSE) http://www.novell.com/linux/security/advisories/2007_19_sr.html -~~	(SUSE) http://www.novell.com/linux/security/advisories/2007_19_sr.html - Broken Link
References	~~(FEDORA) https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00087.html -~~	(FEDORA) https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00087.html - Mailing List
References	~~(CONFIRM) http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt -~~	(CONFIRM) http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt - Vendor Advisory
References	~~(CONFIRM) https://issues.rpath.com/browse/RPL-1696 -~~	(CONFIRM) https://issues.rpath.com/browse/RPL-1696 - Broken Link
References	~~(BID) http://www.securityfocus.com/bid/25533 -~~	(BID) http://www.securityfocus.com/bid/25533 - Broken Link, Third Party Advisory, VDB Entry
References	~~(BUGTRAQ) http://www.securityfocus.com/archive/1/478794/100/0/threaded -~~	(BUGTRAQ) http://www.securityfocus.com/archive/1/478794/100/0/threaded - Third Party Advisory, VDB Entry
CWE	~~CWE-264~~	CWE-824
First Time		Fedoraproject fedora Fedoraproject
CPE	cpe:2.3:a:mit:kerberos_5:1.5.3:::::::* cpe:2.3:a:mit:kerberos_5:1.6.1:::::::* cpe:2.3:a:mit:kerberos_5:1.6.2:::::::* cpe:2.3:a:mit:kerberos_5:1.6:::::::* cpe:2.3:a:mit:kerberos_5:1.5:::::::* cpe:2.3:a:mit:kerberos_5:1.5.1:::::::* cpe:2.3:a:mit:kerberos_5:1.5.2:::::::*	cpe:2.3:o:fedoraproject:fedora:7:::::::* cpe:2.3:a:mit:kerberos_5::::::::

Information

Published : 2007-09-05 10:17

Updated : 2024-02-09 03:24

NVD link : CVE-2007-4000

Mitre link : CVE-2007-4000

JSON object : View

Products Affected

mit

kerberos_5

fedoraproject

fedora

CWE

CWE-824

Access of Uninitialized Pointer

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=250976", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=250976", "tags": ["Issue Tracking"], "refsource": "MISC"}, {"url": "http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt", "name": "http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.redhat.com/support/errata/RHSA-2007-0858.html", "name": "RHSA-2007:0858", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://issues.rpath.com/browse/RPL-1696", "name": "https://issues.rpath.com/browse/RPL-1696", "tags": ["Broken Link"], "refsource": "CONFIRM"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00087.html", "name": "FEDORA-2007-2017", "tags": ["Mailing List"], "refsource": "FEDORA"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-200709-01.xml", "name": "GLSA-200709-01", "tags": ["Third Party Advisory"], "refsource": "GENTOO"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:174", "name": "MDKSA-2007:174", "tags": ["Broken Link"], "refsource": "MANDRIVA"}, {"url": "http://www.novell.com/linux/security/advisories/2007_19_sr.html", "name": "SUSE-SR:2007:019", "tags": ["Broken Link"], "refsource": "SUSE"}, {"url": "http://www.kb.cert.org/vuls/id/377544", "name": "VU#377544", "tags": ["Third Party Advisory", "US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.securityfocus.com/bid/25533", "name": "25533", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1018647", "name": "1018647", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/26680", "name": "26680", "tags": ["Broken Link"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/26728", "name": "26728", "tags": ["Broken Link"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/26676", "name": "26676", "tags": ["Broken Link"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/26700", "name": "26700", "tags": ["Broken Link"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/26783", "name": "26783", "tags": ["Broken Link"], "refsource": "SECUNIA"}, {"url": "http://secunia.com/advisories/26987", "name": "26987", "tags": ["Broken Link"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/3092", "name": "3092", "tags": ["Broken Link"], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2007/3051", "name": "ADV-2007-3051", "tags": ["Broken Link"], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36438", "name": "kerberos-modifypolicy-code-execution(36438)", "tags": ["Broken Link", "VDB Entry"], "refsource": "XF"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9278", "name": "oval:org.mitre.oval:def:9278", "tags": ["Broken Link"], "refsource": "OVAL"}, {"url": "http://www.securityfocus.com/archive/1/478794/100/0/threaded", "name": "20070907 FLEA-2007-0050-1 krb5 krb5-workstation", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the \"modify policy\" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-824"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-4000", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-09-05T10:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.6.2", "versionStartIncluding": "1.5"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2024-02-09T03:24Z"}