10 - CVE-2007-2442

Executive Summary

Informations
Name	CVE-2007-2442	First vendor Publication	2007-06-26
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	10	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2442

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-3	Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-7	Blind SQL Injection
CAPEC-8	Buffer Overflow in an API Call
CAPEC-9	Buffer Overflow in Local Command-Line Utilities
CAPEC-10	Buffer Overflow via Environment Variables
CAPEC-13	Subverting Environment Variable Values
CAPEC-14	Client-side Injection-induced Buffer Overflow
CAPEC-18	Embedding Scripts in Nonscript Elements
CAPEC-22	Exploiting Trust in Client (aka Make the Client Invisible)
CAPEC-24	Filter Failure through Buffer Overflow
CAPEC-28	Fuzzing
CAPEC-31	Accessing/Intercepting/Modifying HTTP Cookies
CAPEC-32	Embedding Scripts in HTTP Query Strings
CAPEC-42	MIME Conversion
CAPEC-43	Exploiting Multiple Input Interpretation Layers
CAPEC-45	Buffer Overflow via Symbolic Links
CAPEC-46	Overflow Variables and Tags
CAPEC-47	Buffer Overflow via Parameter Expansion
CAPEC-52	Embedding NULL Bytes
CAPEC-53	Postfix, Null Terminate, and Backslash
CAPEC-63	Simple Script Injection
CAPEC-64	Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-66	SQL Injection
CAPEC-67	String Format Overflow in syslog()
CAPEC-71	Using Unicode Encoding to Bypass Validation Logic
CAPEC-72	URL Encoding
CAPEC-73	User-Controlled Filename
CAPEC-78	Using Escaped Slashes in Alternate Encoding
CAPEC-79	Using Slashes in Alternate Encoding
CAPEC-80	Using UTF-8 Encoding to Bypass Validation Logic
CAPEC-81	Web Logs Tampering
CAPEC-83	XPath Injection
CAPEC-85	Client Network Footprinting (using AJAX/XSS)
CAPEC-86	Embedding Script (XSS ) in HTTP Headers
CAPEC-88	OS Command Injection
CAPEC-91	XSS in IMG Tags
CAPEC-99	XML Parser Attack
CAPEC-101	Server Side Include (SSI) Injection
CAPEC-104	Cross Zone Scripting
CAPEC-106	Cross Site Scripting through Log Files
CAPEC-108	Command Line Execution through SQL Injection
CAPEC-109	Object Relational Mapping Injection
CAPEC-110	SQL Injection through SOAP Parameter Tampering
CAPEC-171	Variable Manipulation

CWE : Common Weakness Enumeration

%	Id	Name

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10631

Oval ID:	oval:org.mitre.oval:def:10631
Title:	The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.
Description:	The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2442	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-66 AND krb5 is earlier than 0:1.2.7-66 AND krb5-libs is earlier than 0:1.2.7-66 AND krb5-server is earlier than 0:1.2.7-66 AND krb5-devel is earlier than 0:1.2.7-66 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section krb5-workstation is earlier than 0:1.3.4-49 AND krb5 is earlier than 0:1.3.4-49 AND krb5-libs is earlier than 0:1.3.4-49 AND krb5-server is earlier than 0:1.3.4-49 AND krb5-devel is earlier than 0:1.3.4-49 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section krb5-workstation is earlier than 0:1.5-26 AND krb5 is earlier than 0:1.5-26 AND krb5-libs is earlier than 0:1.5-26 AND krb5-server is earlier than 0:1.5-26 AND krb5-devel is earlier than 0:1.5-26

Definition Id: oval:org.mitre.oval:def:7344

Oval ID:	oval:org.mitre.oval:def:7344
Title:	HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code
Description:	The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2442	Version:	11
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41168 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41167 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41166 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than D.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than D.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than D.1.6.2.08 OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests krb5client.KRB5-64SLIB-A version is less than C.1.3.5.10 AND krb5client.KRB5-PRG-A version is less than C.1.3.5.10 AND krb5client.KRB5-RUN-A version is less than C.1.3.5.10 AND krb5client.KRB5-SHLIB-A version is less than C.1.3.5.10 OR Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests krb5client.KRB5-64SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than E.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than E.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than E.1.6.2.08

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mit Kerberos 5 cpe:2.3:a:mit:kerberos_5:1.6.1:::::::* cpe:2.3:a:mit:kerberos_5:1.6:::::::* cpe:2.3:a:mit:kerberos_5:1.5.3:::::::* cpe:2.3:a:mit:kerberos_5:1.5.2:::::::* cpe:2.3:a:mit:kerberos_5:1.5.1:::::::* cpe:2.3:a:mit:kerberos_5:1.5:::::::* cpe:2.3:a:mit:kerberos_5:1.4.4:::::::* cpe:2.3:a:mit:kerberos_5:1.4.3:::::::* cpe:2.3:a:mit:kerberos_5:1.4.2:::::::* cpe:2.3:a:mit:kerberos_5:1.4.1:::::::* cpe:2.3:a:mit:kerberos_5:1.4:::::::* cpe:2.3:a:mit:kerberos_5:1.3.6:::::::* cpe:2.3:a:mit:kerberos_5:1.3.5:::::::* cpe:2.3:a:mit:kerberos_5:1.3.4:::::::* cpe:2.3:a:mit:kerberos_5:1.3.3:::::::* cpe:2.3:a:mit:kerberos_5:1.3.2:::::::* cpe:2.3:a:mit:kerberos_5:1.3.1:::::::* cpe:2.3:a:mit:kerberos_5:1.3:alpha1:::::: cpe:2.3:a:mit:kerberos_5:1.3:-:::::: cpe:2.3:a:mit:kerberos_5:1.2.8:::::::* cpe:2.3:a:mit:kerberos_5:1.2.7:::::::* cpe:2.3:a:mit:kerberos_5:1.2.6:::::::* cpe:2.3:a:mit:kerberos_5:1.2.5:::::::* cpe:2.3:a:mit:kerberos_5:1.2.4:::::::* cpe:2.3:a:mit:kerberos_5:1.2.3:::::::* cpe:2.3:a:mit:kerberos_5:1.2.2:::::::* cpe:2.3:a:mit:kerberos_5:1.2.1:::::::* cpe:2.3:a:mit:kerberos_5:1.2:beta2:::::: cpe:2.3:a:mit:kerberos_5:1.2:beta1:::::: cpe:2.3:a:mit:kerberos_5:1.2:-:::::: cpe:2.3:a:mit:kerberos_5:1.1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.0.6:::::::* cpe:2.3:a:mit:kerberos_5:1.0:-:::::: cpe:2.3:a:mit:kerberos_5:::::::: cpe:2.3:a:mit:kerberos_5:-:::::::*	36
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::* cpe:2.3:o:canonical:ubuntu_linux:6.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::*	3
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:4.0:::::::* cpe:2.3:o:debian:debian_linux:3.1:::::::*	2

OpenVAS Exploits

Date	Description
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-04-09	Name : Mandriva Update for krb5 MDKSA-2007:137 (krb5) File : nvt/gb_mandriva_MDKSA_2007_137.nasl
2009-03-23	Name : Ubuntu Update for krb5 vulnerabilities USN-477-1 File : nvt/gb_ubuntu_USN_477_1.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-0740 File : nvt/gb_fedora_2007_0740_krb5_fc7.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-2017 File : nvt/gb_fedora_2007_2017_krb5_fc7.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-2066 File : nvt/gb_fedora_2007_2066_krb5_fc7.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-620 File : nvt/gb_fedora_2007_620_krb5_fc5.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-621 File : nvt/gb_fedora_2007_621_krb5_fc6.nasl
2009-02-16	Name : Fedora Update for krb5 FEDORA-2008-2637 File : nvt/gb_fedora_2008_2637_krb5_fc7.nasl
2009-01-28	Name : SuSE Update for krb5 SUSE-SA:2007:038 File : nvt/gb_suse_2007_038.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200707-11 (mit-krb5) File : nvt/glsa_200707_11.nasl
2008-01-17	Name : Debian Security Advisory DSA 1323-1 (krb5) File : nvt/deb_1323_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
36596	MIT Kerberos 5 RPC Library gssrpc__svcauth_gssapi Function Remote Code Execution

Snort® IPS/IDS

Date	Description
2014-01-10	MIT Kerberos kadmind rpc library uninitialized pointer arbitrary code executi... RuleID : 13268 - Revision : 5 - Type : RPC
2014-01-10	MIT Kerberos kadmind rpc library uninitialized pointer arbitrary code executi... RuleID : 13223 - Revision : 6 - Type : PROTOCOL-RPC
2014-01-10	MIT Kerberos kadmind rpc library uninitialized pointer arbitrary code executi... RuleID : 12075 - Revision : 10 - Type : PROTOCOL-RPC

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0562.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0384.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070626_krb5_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20070626_krb5_on_SL3.nasl - Type : ACT_GATHER_INFO
2010-06-28	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_41166.nasl - Type : ACT_GATHER_INFO
2010-06-28	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_41167.nasl - Type : ACT_GATHER_INFO
2010-06-28	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_41168.nasl - Type : ACT_GATHER_INFO
2009-07-27	Name : The remote VMware ESX host is missing one or more security-related patches. File : vmware_VMSA-2007-0006.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_krb5-3821.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-477-1.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Fedora host is missing a security update. File : fedora_2007-0740.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_krb5-3820.nasl - Type : ACT_GATHER_INFO
2007-08-02	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2007-007.nasl - Type : ACT_GATHER_INFO
2007-07-27	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200707-11.nasl - Type : ACT_GATHER_INFO
2007-07-01	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1323.nasl - Type : ACT_GATHER_INFO
2007-06-27	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-137.nasl - Type : ACT_GATHER_INFO
2007-06-27	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0384.nasl - Type : ACT_GATHER_INFO
2007-06-27	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0562.nasl - Type : ACT_GATHER_INFO
2007-06-27	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0562.nasl - Type : ACT_GATHER_INFO
2007-06-27	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0384.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc
http://docs.info.apple.com/article.html?artnum=306172
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
http://osvdb.org/36596
http://secunia.com/advisories/25800
http://secunia.com/advisories/25801
http://secunia.com/advisories/25814
http://secunia.com/advisories/25821
http://secunia.com/advisories/25841
http://secunia.com/advisories/25870
http://secunia.com/advisories/25888
http://secunia.com/advisories/25890
http://secunia.com/advisories/25894
http://secunia.com/advisories/25911
http://secunia.com/advisories/26033
http://secunia.com/advisories/26228
http://secunia.com/advisories/26235
http://secunia.com/advisories/26909
http://secunia.com/advisories/27706
http://secunia.com/advisories/40346
http://security.gentoo.org/glsa/glsa-200707-11.xml
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102914-1
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-004.txt
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-004.txt
http://www.debian.org/security/2007/dsa-1323
http://www.kb.cert.org/vuls/id/356961
http://www.mandriva.com/security/advisories?name=MDKSA-2007:137
http://www.novell.com/linux/security/advisories/2007_38_krb5.html
http://www.redhat.com/support/errata/RHSA-2007-0384.html
http://www.redhat.com/support/errata/RHSA-2007-0562.html
http://www.securityfocus.com/archive/1/472288/100/0/threaded
http://www.securityfocus.com/archive/1/472432/100/0/threaded
http://www.securityfocus.com/archive/1/472507/30/5970/threaded
http://www.securityfocus.com/bid/24655
http://www.securityfocus.com/bid/25159
http://www.securitytracker.com/id?1018293
http://www.trustix.org/errata/2007/0021/
http://www.ubuntu.com/usn/usn-477-1
http://www.us-cert.gov/cas/techalerts/TA07-177A.html
http://www.vupen.com/english/advisories/2007/2337
http://www.vupen.com/english/advisories/2007/2354
http://www.vupen.com/english/advisories/2007/2491
http://www.vupen.com/english/advisories/2007/2732
http://www.vupen.com/english/advisories/2007/3229
http://www.vupen.com/english/advisories/2010/1574
https://exchange.xforce.ibmcloud.com/vulnerabilities/35082
https://issues.rpath.com/browse/RPL-1499
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://secure-support.novell.com/KanisaPlatform/Publishing/773/3248163_f.SAL...

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 23:17:01	Multiple Updates
2024-11-28 12:12:13	Multiple Updates
2024-08-02 12:06:49	Multiple Updates
2024-08-02 01:02:17	Multiple Updates
2024-02-09 09:27:58	Multiple Updates
2024-02-02 01:06:27	Multiple Updates
2024-02-01 12:02:16	Multiple Updates
2023-09-05 12:06:01	Multiple Updates
2023-09-05 01:02:08	Multiple Updates
2023-09-02 12:06:08	Multiple Updates
2023-09-02 01:02:08	Multiple Updates
2023-08-12 12:07:07	Multiple Updates
2023-08-12 01:02:08	Multiple Updates
2023-08-11 12:06:10	Multiple Updates
2023-08-11 01:02:12	Multiple Updates
2023-08-06 12:05:52	Multiple Updates
2023-08-06 01:02:09	Multiple Updates
2023-08-04 12:05:58	Multiple Updates
2023-08-04 01:02:12	Multiple Updates
2023-07-14 12:05:57	Multiple Updates
2023-07-14 01:02:10	Multiple Updates
2023-03-29 01:06:39	Multiple Updates
2023-03-28 12:02:15	Multiple Updates
2022-10-11 12:05:16	Multiple Updates
2022-10-11 01:02:00	Multiple Updates
2021-05-04 12:05:56	Multiple Updates
2021-04-22 01:06:30	Multiple Updates
2021-02-02 21:23:17	Multiple Updates
2020-05-23 01:38:09	Multiple Updates
2020-05-23 00:19:42	Multiple Updates
2019-03-19 12:02:26	Multiple Updates
2018-10-16 21:19:56	Multiple Updates
2018-09-25 12:06:32	Multiple Updates
2017-10-11 09:23:56	Multiple Updates
2017-07-29 12:02:12	Multiple Updates
2016-06-28 16:26:24	Multiple Updates
2016-04-26 16:05:11	Multiple Updates
2014-02-17 10:40:04	Multiple Updates
2014-01-19 21:24:05	Multiple Updates
2013-05-11 10:24:47	Multiple Updates
2012-11-07 00:19:25	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	44
CWE ID(s)	1
Oval ID(s)	2
CPE ID(s)	41
Sources(s)	53
osvdb(s)	1
Openvas Exploit(s)	12
Snort® Rule(s)	3
Nessus® Exploit(s)	20

	Related
9.3	VU#356961
9.3	USN-477-1
9.3	SUN-102914
9.3	RHSA-2007:0562
9.3	RHSA-2007:0384
9.3	HPSBUX02544 SSR...
9.3	DSA-1323
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 7 more Alert(s)