Bug 281561 (CVE-2007-4743) - CVE-2007-4743 krb5 incomplete fix for CVE-2007-3999
Summary: CVE-2007-4743 krb5 incomplete fix for CVE-2007-3999
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-4743
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-09-06 22:09 UTC by Josh Bressers
Modified: 2019-09-29 12:21 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-12-22 22:28:47 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0892 0 normal SHIPPED_LIVE Important: krb5 security update 2007-09-07 12:14:46 UTC

Description Josh Bressers 2007-09-06 22:09:37 UTC 
Text taken from MITRE:

The original patch for CVE-2007-3999 in svc_auth_gss.c in the
RPCSEC_GSS RPC library in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as
used by the Kerberos administration daemon (kadmind) and other
applications that use krb5, does not correctly check the buffer length
in some environments and architectures, which might allow remote
attackers to conduct a buffer overflow attack.
Comment 3 Vincent Danen 2010-12-22 22:28:47 UTC 
This was addressed via:

Red Hat Enterprise Linux version 5 (RHSA-2007:0892)
Note You need to log in before you can comment on or make changes to this bug.