Vulnerability Name:

CVE-2007-5894 (CCN-38923)

Assigned:2007-11-15
Published:2007-11-15
Updated:2020-01-21
Summary:** DISPUTED ** The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.
Note: the original disclosure misidentifies the conditions under which the uninitialized variable is used.
Note: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code."
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.6 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:UR)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Denial of Service
References:Source: CCN
Type: Gentoo Bugzilla Bug 199205
app-crypt/mit-krb5 multiple issues (CVE-2007-{5901,5902, 5971, 5972, 5894})

Source: MISC
Type: UNKNOWN
http://bugs.gentoo.org/show_bug.cgi?id=199205

Source: MITRE
Type: CNA
CVE-2007-5894

Source: CCN
Type: Apple Web site
About Security Update 2008-002

Source: OSVDB
Type: UNKNOWN
44333

Source: FULLDISC
Type: UNKNOWN
20071208 MIT Kerberos 5: Multiple vulnerabilities

Source: FULLDISC
Type: UNKNOWN
20071208 Venustech reports of MIT krb5 vulns [CVE-2007-5894 CVE-2007-5901 CVE-2007-5902 CVE-2007-5971 CVE-2007-5972]

Source: SECUNIA
Type: Vendor Advisory
28636

Source: SECUNIA
Type: Vendor Advisory
29457

Source: CCN
Type: MIT Kerberos Web site
Kerberos 5

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/Advisories:rPSA-2008-0112

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0112

Source: CCN
Type: GLSA-200803-31
MIT Kerberos 5: Multiple vulnerabilities

Source: SUSE
Type: UNKNOWN
SUSE-SR:2008:002

Source: CCN
Type: OSVDB ID: 44333
MIT Kerberos 5 (krb5) gssftp ftpd ftpd.c reply Function Security Issue

Source: BUGTRAQ
Type: UNKNOWN
20080319 rPSA-2008-0112-1 krb5 krb5-server krb5-services krb5-test krb5-workstation

Source: BID
Type: UNKNOWN
26750

Source: CCN
Type: BID-26750
MIT Kerberos Multiple Memory Corruption Vulnerabilities

Source: XF
Type: UNKNOWN
kerberos-ftpd-reply-dos(38923)

Source: CONFIRM
Type: UNKNOWN
https://issues.rpath.com/browse/RPL-2012

Source: SUSE
Type: SUSE-SR:2008:002
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mit:kerberos_5:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mit:kerberos_5:-:*:*:*:*:*:*:*
  • AND
  • cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.4.11:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x:10.5.2:*:*:*:*:*:*:*
  • OR cpe:/o:apple:mac_os_x_server:10.5.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20075894
    V
    		CVE-2007-5894
    2022-06-30
    oval:org.opensuse.security:def:112519
    P
    		krb5-1.19.2-2.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:42339
    P
    		Security update for systemd (Moderate)
    2022-01-11
    oval:org.opensuse.security:def:26183
    P
    		Security update for xorg-x11-server (Important)
    2021-12-14
    oval:org.opensuse.security:def:32241
    P
    		Security update for the Linux Kernel (Live Patch 40 for SLE 12 SP3) (Important)
    2021-12-14
    oval:org.opensuse.security:def:31717
    P
    		Security update for openssh (Important)
    2021-12-06
    oval:org.opensuse.security:def:31709
    P
    		Security update for java-1_8_0-openjdk (Important)
    2021-11-23
    oval:org.opensuse.security:def:31708
    P
    		Security update for webkit2gtk3 (Important)
    2021-11-23
    oval:org.opensuse.security:def:32219
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-11-19
    oval:org.opensuse.security:def:26161
    P
    		Security update for samba (Important)
    2021-11-10
    oval:org.opensuse.security:def:42136
    P
    		Security update for salt (Moderate)
    2021-10-27
    oval:org.opensuse.security:def:31283
    P
    		Security update for apache2 (Important)
    2021-10-06
    oval:org.opensuse.security:def:26140
    P
    		Security update for glibc (Moderate)
    2021-10-06
    oval:org.opensuse.security:def:106010
    P
    		krb5-1.19.2-2.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:26112
    P
    		Security update for sssd (Important)
    2021-08-30
    oval:org.opensuse.security:def:32175
    P
    		Security update for the Linux Kernel (Live Patch 40 for SLE 12 SP3) (Important)
    2021-08-25
    oval:org.opensuse.security:def:31260
    P
    		Security update for aspell (Important)
    2021-08-25
    oval:org.opensuse.security:def:32153
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-07-27
    oval:org.opensuse.security:def:31651
    P
    		Security update for libsolv (Important)
    2021-06-28
    oval:org.opensuse.security:def:31209
    P
    		Security update for the Linux Kernel (Live Patch 35 for SLE 12 SP3) (Important)
    2021-06-18
    oval:org.opensuse.security:def:31643
    P
    		Security update for apache2 (Important)
    2021-06-17
    oval:org.opensuse.security:def:31197
    P
    		Security update for ucode-intel (Important)
    2021-06-10
    oval:org.opensuse.security:def:31198
    P
    		Security update for caribou (Important)
    2021-06-10
    oval:org.opensuse.security:def:36430
    P
    		krb5-devel-1.6.3-133.49.66.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42572
    P
    		krb5-1.6.3-133.49.66.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:31632
    P
    		Security update for MozillaFirefox (Important)
    2021-06-08
    oval:org.opensuse.security:def:36165
    P
    		krb5-1.6.3-133.49.66.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:31631
    P
    		Security update for gstreamer-plugins-bad (Important)
    2021-06-07
    oval:org.opensuse.security:def:26059
    P
    		Security update for postgresql12 (Moderate)
    2021-05-27
    oval:org.opensuse.security:def:26055
    P
    		Security update for hivex (Moderate)
    2021-05-26
    oval:org.opensuse.security:def:26056
    P
    		Security update for curl (Moderate)
    2021-05-26
    oval:org.opensuse.security:def:31617
    P
    		Security update for samba (Important)
    2021-05-04
    oval:org.opensuse.security:def:32085
    P
    		Security update for tomcat (Important)
    2021-04-29
    oval:org.opensuse.security:def:32896
    P
    		Security update for xorg-x11-server (Important)
    2021-04-14
    oval:org.opensuse.security:def:32065
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-04-07
    oval:org.opensuse.security:def:26214
    P
    		Security update for wavpack (Important)
    2021-03-24
    oval:org.opensuse.security:def:31352
    P
    		Security update for openldap2 (Important)
    2021-03-03
    oval:org.opensuse.security:def:33089
    P
    		Security update for python-cryptography (Important)
    2021-03-02
    oval:org.opensuse.security:def:26200
    P
    		Security update for glibc (Moderate)
    2021-02-25
    oval:org.opensuse.security:def:31652
    P
    		Security update for openssh (Moderate)
    2021-01-05
    oval:org.opensuse.security:def:32114
    P
    		Security update for java-1_7_1-ibm (Moderate)
    2021-01-04
    oval:org.opensuse.security:def:25980
    P
    		Security update for MozillaFirefox (Critical)
    2020-12-21
    oval:org.opensuse.security:def:25979
    P
    		Security update for xen (Moderate)
    2020-12-18
    oval:org.opensuse.security:def:32009
    P
    		Security update for the Linux Kernel (Live Patch 32 for SLE 12 SP3) (Important)
    2020-12-07
    oval:org.opensuse.security:def:35729
    P
    		krb5-1.6.3-133.48.48.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:41981
    P
    		krb5-1.6.3-133.27.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35932
    P
    		krb5-1.6.3-133.49.54.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35574
    P
    		krb5-1.6.3-133.27.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:25494
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26344
    P
    		Security update for mbedtls (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25901
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:25410
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:33128
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25686
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:31853
    P
    		Security update for coreutils (Important)
    2020-12-01
    oval:org.opensuse.security:def:26432
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26729
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25551
    P
    		Security update for tomcat (Important)
    2020-12-01
    oval:org.opensuse.security:def:31757
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:27128
    P
    		fuse on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25824
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31862
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26264
    P
    		Security update for gegl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25755
    P
    		Security update for libreoffice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31973
    P
    		Security update for jakarta-taglibs-standard (Important)
    2020-12-01
    oval:org.opensuse.security:def:25281
    P
    		Security update for squid (Important)
    2020-12-01
    oval:org.opensuse.security:def:31415
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32539
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25714
    P
    		Security update for libpng16 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26405
    P
    		Security update for sox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25843
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32857
    P
    		expat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25356
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:31564
    P
    		Security update for squid3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26539
    P
    		emacs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25726
    P
    		Security update for python36 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31941
    P
    		Security update for glibc (Important)
    2020-12-01
    oval:org.opensuse.security:def:26609
    P
    		libxslt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26258
    P
    		Security update for openconnect (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31043
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25565
    P
    		Security update for SUSE Manager Client Tools (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31807
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26446
    P
    		Security update for kconfig, kdelibs4 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31399
    P
    		Security update for perl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25918
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26697
    P
    		findutils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26931
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25125
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31128
    P
    		Security update for kvm (Important)
    2020-12-01
    oval:org.opensuse.security:def:25706
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31912
    P
    		Security update for gcc43 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27393
    P
    		empathy on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31411
    P
    		Security update for php53 (Important)
    2020-12-01
    oval:org.opensuse.security:def:32297
    P
    		Security update for procps (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32017
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25137
    P
    		Security update for SDL (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25910
    P
    		Security update for gstreamer-0_10-plugins-base (Low)
    2020-12-01
    oval:org.opensuse.security:def:25483
    P
    		Security update for freeradius-server (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26291
    P
    		Security update for python-reportlab (Important)
    2020-12-01
    oval:org.opensuse.security:def:32385
    P
    		Security update for tightvnc (Important)
    2020-12-01
    oval:org.opensuse.security:def:32694
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25329
    P
    		Security update for spice-gtk (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31496
    P
    		Security update for python-imaging
    2020-12-01
    oval:org.opensuse.security:def:25998
    P
    		Security update for libreoffice (Important)
    2020-12-01
    oval:org.opensuse.security:def:25558
    P
    		Security update for systemd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31766
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26393
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:26694
    P
    		expat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25991
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:25467
    P
    		Security update for ucode-intel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26490
    P
    		Security update for pdns (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25767
    P
    		Security update for DirectFB (Important)
    2020-12-01
    oval:org.opensuse.security:def:26711
    P
    		gnutls on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25702
    P
    		Security update for libvpx (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31796
    P
    		Security update for MozillaFirefox, mozilla-nspr, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:27163
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25280
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25908
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:32500
    P
    		cyrus-imapd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26321
    P
    		Security update for kcoreaddons (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25804
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25292
    P
    		Security update for libX11 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31507
    P
    		Security update for python27 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32407
    P
    		Security update for wget (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25715
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31849
    P
    		Security update for clamav (Important)
    2020-12-01
    oval:org.opensuse.security:def:26556
    P
    		gmime on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26012
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31042
    P
    		Security update for Linux kernel
    2020-12-01
    oval:org.opensuse.security:def:25484
    P
    		Security update for libqt4 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26574
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25790
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:31998
    P
    		Security update for jpeg (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26658
    P
    		MozillaFirefox on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26896
    P
    		foomatic-filters on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31054
    P
    		Security update for the Linux kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25622
    P
    		Security update for wavpack (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31863
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26755
    P
    		libnetpbm10 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31400
    P
    		Security update for perl-Archive-Zip (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25999
    P
    		Security update for zziplib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31818
    P
    		Security update for audiofile (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25126
    P
    		Security update for ovmf (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25857
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31951
    P
    		Security update for grub2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:27428
    P
    		krb5-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25482
    P
    		Security update for man (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31485
    P
    		Security update for python (Important)
    2020-12-01
    oval:org.opensuse.security:def:32346
    P
    		Security update for sqlite3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32655
    P
    		emacs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25201
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:31409
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25959
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32451
    P
    		Security update for xen (Moderate)
    2020-12-01
    BACK
    mit kerberos 5 -
    mit kerberos 5
    gentoo linux *
    apple mac os x 10.4.11
    apple mac os x server 10.4.11
    apple mac os x 10.5.2
    apple mac os x server 10.5.2