10 - CVE-2004-0523

Executive Summary

Informations
Name	CVE-2004-0523	First vendor Publication	2004-08-18
Vendor	Cve	Last vendor Modification	2020-01-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0523

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10295

Oval ID:	oval:org.mitre.oval:def:10295
Title:	Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Description:	Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0523	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-24 AND krb5 is earlier than 0:1.2.7-24 AND krb5-libs is earlier than 0:1.2.7-24 AND krb5-server is earlier than 0:1.2.7-24 AND krb5-devel is earlier than 0:1.2.7-24

Definition Id: oval:org.mitre.oval:def:2002

Oval ID:	oval:org.mitre.oval:def:2002
Title:	Multiple Buffer Overflows in Kerberos 5 (krb5_aname_to_localname)
Description:	Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0523	Version:	2
Platform(s):	Sun Solaris 7	Product(s):	Solaris Enterprise Authentication Mechanism (SEAM)
Definition Synopsis:
Software section Kerberos 5 installed AND Solaris 7,8,or 9 installed Solaris 8 Installed AND Solaris 7 Installed AND Solaris 9 Installed AND NOT Patch 112908-16 or later installed AND NOT Patch 112536-05 or later installed AND NOT Patches 112237-11 and 112390-09 or greater installed Patch 112237-11 or later installed AND Patch 112390-09 or later installed AND Configuration section /etc/krb5/krb5.conf is configured with a kerberos domain AND /etc/krb5/krb5.conf is configured with explicit or rules-based mapping

Definition Id: oval:org.mitre.oval:def:724

Oval ID:	oval:org.mitre.oval:def:724
Title:	MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Name Buffer Overrun Vulnerabilities
Description:	Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0523	Version:	4
Platform(s):	Sun Solaris 9 Sun Solaris 8 Sun Solaris 7	Product(s):
Definition Synopsis:
Software section Solaris 7 (SPARC) meets Sun Alert ID 101512 criteria. Solaris 7 Installed AND sparc architecture AND NOT Patch 112536-05 or later installed OR Solaris 7 (x86) meets Sun Alert ID 101512 criteria. Solaris 7 Installed AND ix86 architecture AND NOT Patch 112537-05 or later installed OR Solaris 8 (SPARC) meets Sun Alert ID 101512 criteria. Solaris 8 Installed AND sparc architecture AND NOT Patch 112237-11 or later installed AND NOT Patch 112390-09 or later installed OR Solaris 8 (x86) meets Sun Alert ID 101512 criteria. Solaris 8 Installed AND ix86 architecture AND NOT Patch 112240-08 or later installed AND NOT Patch 112238-10 or later installed OR Solaris 9 (SPARC) meets Sun Alert ID 101512 criteria. Solaris 9 Installed AND sparc architecture AND NOT Patch 112908-15 or later installed OR Solaris 9 (x86) meets Sun Alert ID 101512 criteria. Solaris 9 Installed AND ix86 architecture AND NOT Patch 115168-05 or later installed AND Configuration section Target's configuration meets 101512 configuration criteria. Solaris Enterprise Authentication Mechanism (ANY SUNWkr5sl/SUNWkr5sv/SUNWkrgdo/SUNWkrggl) Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5sv) installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5sl) installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkrgdo) installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkrggl) installed OR SEAM is not installed, but target is a kerberos client. NOT Solaris Enterprise Authentication Mechanism (ANY SUNWkr5sl/SUNWkr5sv/SUNWkrgdo/SUNWkrggl) Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5sv) installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5sl) installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkrgdo) installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkrggl) installed AND /etc/krb5/krb5.conf is configured as a kerberos client

Definition Id: oval:org.mitre.oval:def:991

Oval ID:	oval:org.mitre.oval:def:991
Title:	Multiple BO Vulnerabilities in MIT Kerberos 5
Description:	Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0523	Version:	4
Platform(s):	Red Hat Enterprise Linux 3	Product(s):	MIT Kerberos 5 (krb5)
Definition Synopsis:
ix86 architecture AND Red Hat Enterprise 3 is installed AND krb5-libs rpm version prior to 1.2.7-24 is installed

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mit Kerberos cpe:2.3:a:mit:kerberos:1.2.2.beta1:::::::* cpe:2.3:a:mit:kerberos:1.0.8:::::::* cpe:2.3:a:mit:kerberos:1.0:::::::*	3
Application	Mit Kerberos 5 cpe:2.3:a:mit:kerberos_5:1.3.3:::::::* cpe:2.3:a:mit:kerberos_5:1.3:alpha1:::::: cpe:2.3:a:mit:kerberos_5:1.3:-:::::: cpe:2.3:a:mit:kerberos_5:1.2.7:::::::* cpe:2.3:a:mit:kerberos_5:1.2.6:::::::* cpe:2.3:a:mit:kerberos_5:1.2.5:::::::* cpe:2.3:a:mit:kerberos_5:1.2.4:::::::* cpe:2.3:a:mit:kerberos_5:1.2.3:::::::* cpe:2.3:a:mit:kerberos_5:1.2.2:::::::* cpe:2.3:a:mit:kerberos_5:1.2.1:::::::* cpe:2.3:a:mit:kerberos_5:1.2:-:::::: cpe:2.3:a:mit:kerberos_5:1.2:beta1:::::: cpe:2.3:a:mit:kerberos_5:1.2:beta2:::::: cpe:2.3:a:mit:kerberos_5:1.1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.0.6:::::::* cpe:2.3:a:mit:kerberos_5:1.0:-::::::	17
Application	Sgi Propack cpe:2.3:a:sgi:propack:3.0:::::::* cpe:2.3:a:sgi:propack:2.4:::::::*	2
Application	Sun Seam cpe:2.3:a:sun:seam:1.0.2:::::::* cpe:2.3:a:sun:seam:1.0.1:::::::* cpe:2.3:a:sun:seam:1.0:::::::*	3
Application	Tinysofa Tinysofa Enterprise Server cpe:2.3:a:tinysofa:tinysofa_enterprise_server:1.0_u1:::::::* cpe:2.3:a:tinysofa:tinysofa_enterprise_server:1.0:::::::*	2
Os	Sun Solaris cpe:2.3:o:sun:solaris:9.0::x86::::: cpe:2.3:o:sun:solaris:9.0::sparc::::: cpe:2.3:o:sun:solaris:8.0::x86:::::	3
Os	Sun Sunos cpe:2.3:o:sun:sunos:5.8:::::::*	1

OpenVAS Exploits

Date	Description
2008-09-24	Name : Gentoo Security Advisory GLSA 200406-21 (mit-krb5) File : nvt/glsa_200406_21.nasl
2008-01-17	Name : Debian Security Advisory DSA 520-1 (krb5) File : nvt/deb_520_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
6846	MIT Kerberos 5 krb5_aname_to_localname() Buffer Overflow A remote overflow exists in Kerberos 5. Kerberos fails to check the string length in the functions aname_replacer(), do_replacement() and rule_an_to_ln() resulting in a heap buffer overflow. With a specially crafted request, an attacker can gain remote access as root resulting in a loss of confidentiality, integrity, and/or availability. This vulnerability only exists when the software is used with a non-standard configuration. Please see the MIT release notes for the details.

Description

6846

MIT Kerberos 5 krb5_aname_to_localname() Buffer Overflow

A remote overflow exists in Kerberos 5. Kerberos fails to check the string length in the functions aname_replacer(), do_replacement() and rule_an_to_ln() resulting in a heap buffer overflow. With a specially crafted request, an attacker can gain remote access as root resulting in a loss of confidentiality, integrity, and/or availability. This vulnerability only exists when the software is used with a non-standard configuration. Please see the MIT release notes for the details.

Nessus® Vulnerability Scanner

Date	Description
2006-11-06	Name : The remote host is missing Sun Security Patch number 112536-06 File : solaris7_112536.nasl - Type : ACT_GATHER_INFO
2006-11-06	Name : The remote host is missing Sun Security Patch number 112537-06 File : solaris7_x86_112537.nasl - Type : ACT_GATHER_INFO
2004-09-29	Name : The remote Debian host is missing a security-related update. File : debian_DSA-520.nasl - Type : ACT_GATHER_INFO
2004-09-08	Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd20040907.nasl - Type : ACT_GATHER_INFO
2004-08-30	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200406-21.nasl - Type : ACT_GATHER_INFO
2004-07-31	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-056.nasl - Type : ACT_GATHER_INFO
2004-07-23	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-149.nasl - Type : ACT_GATHER_INFO
2004-07-23	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-150.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 112908-38 File : solaris9_112908.nasl - Type : ACT_GATHER_INFO
2004-07-12	Name : The remote host is missing Sun Security Patch number 115168-24 File : solaris9_x86_115168.nasl - Type : ACT_GATHER_INFO
2004-07-06	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2004-236.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/10448
BUGTRAQ	http://marc.info/?l=bugtraq&m=108612325909496&w=2 http://marc.info/?l=bugtraq&m=108619161815320&w=2
CERT-VN	http://www.kb.cert.org/vuls/id/686862
CONECTIVA	http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000860
DEBIAN	http://www.debian.org/security/2004/dsa-520
FEDORA	http://lwn.net/Articles/88206/
GENTOO	http://www.gentoo.org/security/en/glsa/glsa-200406-21.xml
MANDRAKE	http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:056
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova... https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://www.redhat.com/support/errata/RHSA-2004-236.html
SGI	ftp://patches.sgi.com/support/free/security/advisories/20040604-01-U.asc ftp://patches.sgi.com/support/free/security/advisories/20040605-01-U.asc
SUNALERT	http://sunsolve.sun.com/search/document.do?assetkey=1-26-101512-1
TRUSTIX	http://marc.info/?l=bugtraq&m=108619250923790&w=2
XF	https://exchange.xforce.ibmcloud.com/vulnerabilities/16268

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-02 01:02:34	Multiple Updates
2024-02-01 12:01:31	Multiple Updates
2023-09-05 12:02:26	Multiple Updates
2023-09-05 01:01:23	Multiple Updates
2023-09-02 12:02:27	Multiple Updates
2023-09-02 01:01:23	Multiple Updates
2023-08-12 12:02:58	Multiple Updates
2023-08-12 01:01:23	Multiple Updates
2023-08-11 12:02:33	Multiple Updates
2023-08-11 01:01:24	Multiple Updates
2023-08-06 12:02:22	Multiple Updates
2023-08-06 01:01:24	Multiple Updates
2023-08-04 12:02:25	Multiple Updates
2023-08-04 01:01:24	Multiple Updates
2023-07-14 12:02:24	Multiple Updates
2023-07-14 01:01:24	Multiple Updates
2023-03-29 01:02:26	Multiple Updates
2023-03-28 12:01:29	Multiple Updates
2022-10-11 12:02:09	Multiple Updates
2022-10-11 01:01:17	Multiple Updates
2021-05-04 12:02:20	Multiple Updates
2021-04-22 01:02:29	Multiple Updates
2020-05-23 00:15:48	Multiple Updates
2018-10-31 00:19:43	Multiple Updates
2017-10-11 09:23:21	Multiple Updates
2017-07-11 12:01:27	Multiple Updates
2016-10-18 12:01:20	Multiple Updates
2016-06-28 15:05:53	Multiple Updates
2016-04-26 12:50:40	Multiple Updates
2014-02-17 10:27:38	Multiple Updates
2013-05-11 11:41:58	Multiple Updates

Global Informations

Type	Count
Oval ID(s)	4
CPE ID(s)	31
Sources(s)	19
osvdb(s)	1
Openvas Exploit(s)	2
Nessus® Exploit(s)	11

	Related
10	RHSA-2004:236
10	DSA-520
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

10 - CVE-2004-0523

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU