krb5: unauthorized root privileges [LWN.net]

Package(s):

krb5

CVE #(s):

CAN-2004-0523

Created:

June 3, 2004

Updated:

June 29, 2004

Description:

Multiple buffer overflows exist in the krb5_aname_to_localname() library function that if exploited could lead to unauthorized root privileges. In order to exploit this flaw, an attacker must first successfully authenticate to a vulnerable service, which must be configured to enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname, which is not a default configuration. See the this MIT krb5 Security Advisory for more information.

Alerts:

Gentoo	200406-21	2004-06-29
Debian	DSA-520-1	2004-06-16
Whitebox	WBSA-2004:236-01	2004-06-10
Mandrake	MDKSA-2004:056-1	2004-06-09
Red Hat	RHSA-2004:236-01	2004-06-09
Fedora	FEDORA-2004-150	2004-06-04
Fedora	FEDORA-2004-149	2004-06-04
Mandrake	MDKSA-2004:056	2004-06-03

(Log in to post comments)