The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.

The remote host is affected by the vulnerability described in GLSA-200803-31 (MIT Kerberos 5: Multiple vulnerabilities)

    Two vulnerabilities were found in the Kerberos 4 support in     KDC: A global variable is not set for some incoming message types,     leading to a NULL pointer dereference or a double free()     (CVE-2008-0062) and unused portions of a buffer are not properly     cleared when generating an error message, which results in stack     content being contained in a reply (CVE-2008-0063).
    Jeff     Altman (Secure Endpoints) discovered a buffer overflow in the RPC     library server code, used in the kadmin server, caused when too many     file descriptors are opened (CVE-2008-0947).
    Venustech AD-LAB     discovered multiple vulnerabilities in the GSSAPI library: usage of a     freed variable in the gss_indicate_mechs() function (CVE-2007-5901) and     a double free() vulnerability in the gss_krb5int_make_seal_token_v3()     function (CVE-2007-5971).
  Impact :

    The first two vulnerabilities can be exploited by a remote     unauthenticated attacker to execute arbitrary code on the host running     krb5kdc, compromise the Kerberos key database or cause a Denial of     Service. These bugs can only be triggered when Kerberos 4 support is     enabled.
    The RPC related vulnerability can be exploited by a remote     unauthenticated attacker to crash kadmind, and theoretically execute     arbitrary code with root privileges or cause database corruption. This     bug can only be triggered in configurations that allow large numbers of     open file descriptors in a process.
    The GSSAPI vulnerabilities could be exploited by a remote attacker to     cause Denial of Service conditions or possibly execute arbitrary code.
  Workaround :

    Kerberos 4 support can be disabled via disabling the 'krb4' USE flag     and recompiling the ebuild, or setting 'v4_mode=none' in the     [kdcdefaults] section of /etc/krb5/kdc.conf. This will only work around     the KDC related vulnerabilities.

This update fixes multiple vulnerabilities in krb5. It's unlikely that those vulnerabilities can actually be exploited. (CVE-2007-5894 / CVE-2007-5902 / CVE-2007-5971 / CVE-2007-5972)

This update fixes multiple vulnerabilities in krb5. It's unlikely that those vulnerabilities can actually be exploited. (CVE-2007-5894, CVE-2007-5902, CVE-2007-5971, CVE-2007-5972)

ID	Name	Product	Family	Severity
31671	GLSA-200803-31 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
29992	SuSE 10 Security Update : Kerberos (ZYPP Patch Number 4852)	Nessus	SuSE Local Security Checks	critical
29991	openSUSE 10 Security Update : krb5 (krb5-4851)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2007-5894

high

Tenable Plugins

critical

critical

critical