CVE-2008-0063 — Use of Uninitialized Resource in Kerberos 5

CWE-908 — Use of Uninitialized ResourceCWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-94 — Code Injection12 documents9 sources
Severity
7.5HIGHNVD
GHSA7.3
EPSS
4.9%
top 10.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
12
MIT Krb5Apple MAC OS XApple MAC OS X Server+9 more
Timeline
PublishedMar 19
Latest updateJul 14

Description

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages9 packages

▶NVDmit/kerberos_51.6.3
▶NVDapple/mac_os_x10.5.0 — 10.5.2+1
▶NVDapple/mac_os_x_server10.5.0 — 10.5.2+1
▶Debianmit/krb5< 1.6.dfsg.3~beta1-4+3
▶NVDsuse/linux10.1

Also affects: Debian Linux 3.1, 4.0, Fedora 7, 8, Ubuntu Linux 6.06, 6.10, 7.04, 7.10

Patches

Patch: www.mandriva.com ↗Patch: www.mandriva.com ↗Patch: www.mandriva.com ↗

🔴Vulnerability Details

4
GHSA
SwiftTerm Code Injection vulnerability↗2023-07-14
▶
GHSA
GHSA-67px-r9v8-hcfg: The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, whi↗2022-05-01
▶
CVEList
CVE-2008-0063: The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, whi↗2008-03-19
▶
OSV
CVE-2008-0063: The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, whi↗2008-03-19
▶

📋Vendor Advisories

4
Red Hat
xterm: arbitrary command injection↗2008-12-29
▶
Ubuntu
Kerberos vulnerabilities↗2008-03-19
▶
Red Hat
krb5: possible leak of sensitive data from krb5kdc using krb4 request↗2008-03-18
▶
Debian
CVE-2008-0063: krb5 - The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clea...↗2008
▶

💬Community

2
Bugzilla
CVE-2008-0063 krb5: possible leak of sensitive data from krb5kdc using krb4 request↗2008-02-13
▶
Bugzilla
CVE-2008-0062 krb5: uninitialized pointer use in krb5kdc↗2008-02-13
▶
CVE-2008-0063 — Use of Uninitialized Resource | cvebase