CVE-2007-2442: Critical severity MIT Kerberos 5 vulnerability
Published Jun 26, 2007
·Updated
The gssrpcsvcauthgssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.
Affected Software
6 affected components
MIT Kerberos 5<=1.6.1
Debian Debian Linux=3.1
Debian Debian Linux=4.0
Canonical Ubuntu Linux=6.06
Canonical Ubuntu Linux=6.10
Canonical Ubuntu Linux=7.04
Remediation
Patch Available
Patch Available
Event History
Jun 26, 2007
CVE Published
via NVD·10:30 PM
Jun 27, 2007
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2442?
CVE-2007-2442 has a medium severity level due to the potential for remote code execution.
2
How do I fix CVE-2007-2442?
To fix CVE-2007-2442, upgrade to MIT Kerberos 5 version 1.6.2 or later.
3
Which software versions are affected by CVE-2007-2442?
CVE-2007-2442 affects MIT Kerberos 5 version 1.6.1 and earlier, as well as specific versions of Debian and Ubuntu Linux.
4
What type of vulnerability is CVE-2007-2442?
CVE-2007-2442 is a remote code execution vulnerability in the RPC library of MIT Kerberos 5.
5
Who can exploit CVE-2007-2442?
Remote attackers can exploit CVE-2007-2442 using a zero-length RPC credential.