MIT Kerberos kadmind RPC Library Memory Vulnerabilities (CVE-2007-2442/2443) Advisory

--- Vulnerability Overview Release & Update: Release Date: 2007-06-26 Last Updated: 2007-06-26 Subject & Severity: Subject: kadmin affected by multiple vulnerabilities in RPC library Severity: Critical (CRITICAL) CVE IDs: CVE-2007-2442, CERT: VU#356961 CVE-2007-2443, CERT: VU#365313 --- Vulnerability Details CVE-2007-2442 Description: The RPC library used by the MIT krb5 Kerberos administration daemon (kadmind) may free uninitialized pointers, potentially leading to arbitrary code execution. Affected File: CVE-2007-2443 Description: The RPC library may write beyond the bounds of a stack buffer, which in some cases could lead to arbitrary code execution. Affected File: --- Affected Scope Software Versions: - kadmind: MIT krb5-1.6.1 and earlier versions - Third-party applications using MIT krb5 RPC library --- Mitigation & Fixes Remediation: Fixes included in krb5-1.6.2 and krb5-1.5.4 maintenance releases. Prior to new releases, apply the patch file. Patch Download Links: - http://web.mit.edu/kerberos/advisories/2007-004-patch.txt (unencrypted) - http://web.mit.edu/kerberos/advisories/2007-004-patch.txt.asc (PGP-signed) --- References Full Advisory: http://web.mit.edu/kerberos/advisories/2007-004.txt MIT Kerberos Security Advisories: http://web.mit.edu/kerberos/advisories/index.html MIT Kerberos Homepage: http://web.mit.edu/kerberos/index.html External Vulnerability References: CVE and CERT links as listed above.

Goal Reached Thanks to every supporter — we hit 100%!

MIT Kerberos kadmind RPC Library Memory Vulnerabilities (CVE-2007-2442/2443) Advisory