CVE-2007-5894

published 2007-12-06

CVE-2007-5894: The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has…

Priority P4 30 critical 9.3 CVSS 2.0

AV N AC M Au N C C I C A C

The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	krb5	< krb5 1.6.dfsg.4~beta1-1 (bookworm)	krb5 1.6.dfsg.4~beta1-1 (bookworm)
mit	krb5	>= 0 < 1.6.dfsg.4~beta1-1	1.6.dfsg.4~beta1-1
mit	krb5	>= 0 < 1.6.dfsg.4~beta1-1	1.6.dfsg.4~beta1-1
mit	krb5	>= 0 < 1.6.dfsg.4~beta1-1	1.6.dfsg.4~beta1-1
mit	krb5	>= 0 < 1.6.dfsg.4~beta1-1	1.6.dfsg.4~beta1-1

CVSS provenance

nvd v2.0 9.3 CRITICAL AV:N/AC:M/Au:N/C:C/I:C/A:C

osv 9.3 CRITICAL

vendor_debian 9.3 LOW

vendor_redhat 9.3 CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.