CVE-2008-0948: Buffer Overflow

Published Mar 19, 2008

Updated

Buffer overflow in the RPC library (lib/rpc/rpcdtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FDSETSIZE macro, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering a large number of open file descriptors.

Affected Software

1 affected component

MIT Kerberos 5=1.2.2

Event History

Mar 19, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0948?

CVE-2008-0948 is considered a moderate severity vulnerability as it can lead to a denial of service.

How do I fix CVE-2008-0948?

To fix CVE-2008-0948, update MIT Kerberos 5 to version 1.3 or later where the vulnerability is not present.

Which versions of MIT Kerberos are affected by CVE-2008-0948?

CVE-2008-0948 affects MIT Kerberos 5 versions prior to 1.3, specifically version 1.2.2.

What type of vulnerability is CVE-2008-0948?

CVE-2008-0948 is a buffer overflow vulnerability in the RPC library used by libgssrpc and kadmind.

Can CVE-2008-0948 be exploited remotely?

Yes, CVE-2008-0948 can be exploited remotely by attackers, leading to potential crashes of the affected service.