Mit Kerberos 5 -

The get_input_token function in the SPNEGO implementation in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to cause a denial of service (daemon crash) and possibly obtain sensitive information via a crafted length value that triggers a buffer over-read.

Published: 2009-04-09T00:00:00.000Z
Updated: 2024-08-07T04:48:52.434Z

Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.

Published: 2007-12-06T02:00:00.000Z
Updated: 2024-08-07T15:47:00.452Z

The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.

Published: 2007-12-06T02:00:00.000Z
Updated: 2024-08-07T15:47:00.553Z

sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."

Published: 2007-06-11T18:00:00.000Z
Updated: 2024-08-07T14:05:29.234Z

The dtlogin program in Compaq Tru64 UNIX allows local users to gain root privileges.

Published: 2000-01-04T05:00:00.000Z
Updated: 2024-08-01T16:48:37.734Z