CVE-2007-2443: High severity MIT Kerberos 5 vulnerability
Published Jun 26, 2007
·Updated
Integer signedness error in the gssrpcsvcauthunix function in svcauthunix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.
Affected Software
6 affected components
MIT Kerberos 5<=1.6.1
Debian Debian Linux=3.1
Debian Debian Linux=4.0
Canonical Ubuntu Linux=7.04
Canonical Ubuntu Linux=6.10
Canonical Ubuntu Linux=6.06
Remediation
Patch Available
Patch Available
Event History
Jun 26, 2007
CVE Published
10:30 PM
Jun 27, 2007
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-2443?
CVE-2007-2443 is considered a high severity vulnerability due to its potential to allow remote code execution.
2
How do I fix CVE-2007-2443?
To remediate CVE-2007-2443, upgrade to MIT Kerberos 5 version 1.6.2 or later.
3
Which versions of Kerberos are affected by CVE-2007-2443?
CVE-2007-2443 affects MIT Kerberos 5 versions 1.6.1 and earlier.
4
Can CVE-2007-2443 be exploited remotely?
Yes, CVE-2007-2443 can be exploited by remote attackers due to an integer signedness error.
5
What systems are vulnerable to CVE-2007-2443?
Systems like Debian GNU/Linux versions 3.1 and 4.0, and Ubuntu Linux versions 6.06, 6.10, and 7.04 are vulnerable to CVE-2007-2443.