<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd"> <glsa id="200707-11"> <title>MIT Kerberos 5: Arbitrary remote code execution</title> <synopsis> Multiple vulnerabilities in MIT Kerberos 5 could potentially result in remote code execution with root privileges by unauthenticated users. </synopsis> <product type="ebuild">mit-krb5</product> <announced>2007-07-25</announced> <revised count="01">2007-07-25</revised> <bug>183338</bug> <access>remote</access> <affected> <package name="app-crypt/mit-krb5" auto="yes" arch="*"> <unaffected range="ge">1.5.2-r3</unaffected> <vulnerable range="lt">1.5.2-r3</vulnerable> </package> </affected> <background> <p> MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. </p> </background> <description> <p> kadmind is affected by multiple vulnerabilities in the RPC library shipped with MIT Kerberos 5. It fails to properly handle zero-length RPC credentials (CVE-2007-2442) and the RPC library can write past the end of the stack buffer (CVE-2007-2443). Furthermore kadmind fails to do proper bounds checking (CVE-2007-2798). </p> </description> <impact type="high"> <p> A remote unauthenticated attacker could exploit these vulnerabilities to execute arbitrary code with root privileges. </p> </impact> <workaround> <p> There is no known workaround at this time. </p> </workaround> <resolution> <p> All MIT Kerberos 5 users should upgrade to the latest version: </p> <code> # emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.5.2-r3"</code> </resolution> <references> <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2442">CVE-2007-2442</uri> <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2443">CVE-2007-2443</uri> <uri link="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2798">CVE-2007-2798</uri> </references> <metadata tag="requester" timestamp="2007-07-15T07:39:18Z"> jaervosz </metadata> <metadata tag="submitter" timestamp="2007-07-16T20:11:47Z"> jaervosz </metadata> <metadata tag="bugReady" timestamp="2007-07-17T17:56:29Z"> jaervosz </metadata> </glsa>