heimdal: insufficient memory allocation [LWN.net]

Package(s):

heimdal

CVE #(s):

CVE-2007-5939

Created:

December 7, 2007

Updated:

December 12, 2007

Description:

The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username. NOTE: the vulnerability was originally reported for ftpd.c, but this is incorrect.

Alerts:

Mandriva

MDKSA-2007:239

2007-12-06

(Log in to post comments)

heimdal: insufficient memory allocation

Posted Dec 16, 2007 14:21 UTC (Sun) by kreutzm (subscriber, #4700) [Link]

Debian Sarge and Etch are not vulnerable.