NVD

Id
57921  
Name
CVE-2007-5894  
Description
** DISPUTED ** The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The "length" variable is only uninitialized if "auth_type" is neither the "KERBEROS_V4" nor "GSSAPI"; this condition cannot occur in the unmodified source code."  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-12-05  
Modified Date
2008-11-15  
Seq
2007-5894  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
296458 57921 CVE-2007-5894 http://bugs.gentoo.org/show_bug.cgi?id=199205  View
296459 57921 CVE-2007-5894 20071208 MIT Kerberos 5: Multiple vulnerabilities  View
296460 57921 CVE-2007-5894 20071208 Venustech reports of MIT krb5 vulns [CVE-2007-5894 CVE-2007-5901 CVE-2007-5902 CVE-2007-5971 CVE-2007-5972]  View
296461 57921 CVE-2007-5894 http://wiki.rpath.com/Advisories:rPSA-2008-0112  View
296462 57921 CVE-2007-5894 http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0112  View
296463 57921 CVE-2007-5894 SUSE-SR:2008:002  View
296464 57921 CVE-2007-5894 20080319 rPSA-2008-0112-1 krb5 krb5-server krb5-services krb5-test krb5-workstation  View
296465 57921 CVE-2007-5894 26750  View
296466 57921 CVE-2007-5894 https://issues.rpath.com/browse/RPL-2012  View

Related JVN