NVD

Id
71578  
Name
CVE-2004-1189  
Description
The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-07-18  
Published
2004-12-31  
Modified Date
2017-07-10  
Seq
2004-1189  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
370285 71578 CVE-2004-1189 CLA-2005:917  View
370286 71578 CVE-2004-1189 APPLE-SA-2005-08-17  View
370287 71578 CVE-2004-1189 APPLE-SA-2005-08-15  View
370288 71578 CVE-2004-1189 20041220 MITKRB5-SA-2004-004: heap overflow in libkadm5srv  View
370289 71578 CVE-2004-1189 20050110 [USN-58-1] MIT Kerberos server vulnerability  View
370290 71578 CVE-2004-1189 oval:org.mitre.oval:def:11911  View
370291 71578 CVE-2004-1189 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt  View
370292 71578 CVE-2004-1189 MDKSA-2004:156  View
370293 71578 CVE-2004-1189 RHSA-2005:012  View
370294 71578 CVE-2004-1189 RHSA-2005:045  View
370295 71578 CVE-2004-1189 2004-0069  View
370296 71578 CVE-2004-1189 kerberos-libkadm5srv-bo(18621)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
63226 JVNDB-2004-000568 MIT Kerberos の libkadm5srv におけるヒープオーバーフローの脆弱性 MIT Kerberos に含まれる libkadm5srv で使用する add_to_history() 関数には、パスワード変更履歴の処理に不備が存在し、特定のパスワード変更履歴の状態にある principal のパスワードを変更した場合にヒープオーバーフローが発生する脆弱性が存在します。 CVE-2004-1189 9616 CVE-2004-1189 71578 7.2 http://jvndb.jvn.jp/ja/contents/2004/JVNDB-2004-000568.html 2004-12-20 2007-04-01 View