CVE-2007-4743: Buffer Overflow

Published Sep 6, 2007

Updated

The original patch for CVE-2007-3999 in svcauthgss.c in the RPCSECGSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and other applications that use krb5, does not correctly check the buffer length in some environments and architectures, which might allow remote attackers to conduct a buffer overflow attack.

Affected Software

12 affected components

MIT Kerberos 5=1.4

MIT Kerberos 5=1.4.1

MIT Kerberos 5=1.4.2

MIT Kerberos 5=1.4.3

MIT Kerberos 5=1.4.4

MIT Kerberos 5=1.5

MIT Kerberos 5=1.5.1

MIT Kerberos 5=1.5.2

MIT Kerberos 5=1.5.3

MIT Kerberos 5=1.6

MIT Kerberos 5=1.6.1

MIT Kerberos 5=1.6.2

Remediation

Patch Available

http://article.gmane.org/gmane.comp.encryption.kerberos.announce/86

Event History

Sep 6, 2007

CVE Published

10:17 PM

Sep 7, 2007

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4743?

CVE-2007-4743 has a moderate severity rating due to potential exploitation that could lead to denial of service.

How do I fix CVE-2007-4743?

To fix CVE-2007-4743, upgrade to the latest version of MIT Kerberos 5 that addresses this vulnerability.

What versions of MIT Kerberos 5 are affected by CVE-2007-4743?

CVE-2007-4743 affects MIT Kerberos 5 versions 1.4 through 1.6.2.

Can CVE-2007-4743 lead to data loss?

CVE-2007-4743 primarily causes a denial of service but does not directly allow unauthorized data access or loss.

What component is impacted by CVE-2007-4743?

CVE-2007-4743 impacts the RPCSEC_GSS RPC library component used in MIT Kerberos 5.