github - ghsa-cpvg-gx3j-rfm4

ghsa-cpvg-gx3j-rfm4

Vulnerability from github

Published

2022-05-01 18:38

Modified

2022-05-01 18:38

Details

Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors. NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2007-5972"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-119"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2007-12-06T02:46:00Z",
    "severity": "HIGH"
  },
  "details": "Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors.  NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key.",
  "id": "GHSA-cpvg-gx3j-rfm4",
  "modified": "2022-05-01T18:38:18Z",
  "published": "2022-05-01T18:38:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5972"
    },
    {
      "type": "WEB",
      "url": "https://issues.rpath.com/browse/RPL-2012"
    },
    {
      "type": "WEB",
      "url": "http://bugs.gentoo.org/show_bug.cgi?id=199211"
    },
    {
      "type": "WEB",
      "url": "http://osvdb.org/44747"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2007/Dec/0176.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2007/Dec/0321.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/28636"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/39290"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/39784"
    },
    {
      "type": "WEB",
      "url": "http://ubuntu.com/usn/usn-924-1"
    },
    {
      "type": "WEB",
      "url": "http://www.novell.com/linux/security/advisories/suse_security_summary_report.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/26750"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-940-1"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2010/1192"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

cve-2007-5972

Vulnerability from cvelistv5

Published

2007-12-06 02:00

Modified

2024-08-07 15:47

Severity ?

Summary

References

▼	URL	Tags
	http://secunia.com/advisories/39784	third-party-advisory, x_refsource_SECUNIA
	http://www.ubuntu.com/usn/USN-940-1	vendor-advisory, x_refsource_UBUNTU
	http://www.novell.com/linux/security/advisories/suse_security_summary_report.html	vendor-advisory, x_refsource_SUSE
	http://www.securityfocus.com/bid/26750	vdb-entry, x_refsource_BID
	http://seclists.org/fulldisclosure/2007/Dec/0321.html	mailing-list, x_refsource_FULLDISC
	http://www.vupen.com/english/advisories/2010/1192	vdb-entry, x_refsource_VUPEN
	http://osvdb.org/44747	vdb-entry, x_refsource_OSVDB
	http://seclists.org/fulldisclosure/2007/Dec/0176.html	mailing-list, x_refsource_FULLDISC
	http://secunia.com/advisories/39290	third-party-advisory, x_refsource_SECUNIA
	http://ubuntu.com/usn/usn-924-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/28636	third-party-advisory, x_refsource_SECUNIA
	http://bugs.gentoo.org/show_bug.cgi?id=199211	x_refsource_MISC
	https://issues.rpath.com/browse/RPL-2012	x_refsource_CONFIRM

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:47:00.635Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "39784",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/39784"
          },
          {
            "name": "USN-940-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/USN-940-1"
          },
          {
            "name": "SUSE-SR:2008:002",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/suse_security_summary_report.html"
          },
          {
            "name": "26750",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/26750"
          },
          {
            "name": "20071208 Venustech reports of MIT krb5 vulns [CVE-2007-5894 CVE-2007-5901 CVE-2007-5902 CVE-2007-5971 CVE-2007-5972]",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2007/Dec/0321.html"
          },
          {
            "name": "ADV-2010-1192",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/1192"
          },
          {
            "name": "44747",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/44747"
          },
          {
            "name": "20071208 MIT Kerberos 5: Multiple vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2007/Dec/0176.html"
          },
          {
            "name": "39290",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/39290"
          },
          {
            "name": "USN-924-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://ubuntu.com/usn/usn-924-1"
          },
          {
            "name": "28636",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28636"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bugs.gentoo.org/show_bug.cgi?id=199211"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-2012"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-12-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors.  NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2007-12-12T10:00:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "39784",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/39784"
        },
        {
          "name": "USN-940-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/USN-940-1"
        },
        {
          "name": "SUSE-SR:2008:002",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/suse_security_summary_report.html"
        },
        {
          "name": "26750",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/26750"
        },
        {
          "name": "20071208 Venustech reports of MIT krb5 vulns [CVE-2007-5894 CVE-2007-5901 CVE-2007-5902 CVE-2007-5971 CVE-2007-5972]",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2007/Dec/0321.html"
        },
        {
          "name": "ADV-2010-1192",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/1192"
        },
        {
          "name": "44747",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/44747"
        },
        {
          "name": "20071208 MIT Kerberos 5: Multiple vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2007/Dec/0176.html"
        },
        {
          "name": "39290",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/39290"
        },
        {
          "name": "USN-924-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://ubuntu.com/usn/usn-924-1"
        },
        {
          "name": "28636",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28636"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bugs.gentoo.org/show_bug.cgi?id=199211"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-2012"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-5972",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Double free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors.  NOTE: the free operations occur in code that stores the krb5kdc master key, and so the attacker must have privileges to store this key."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "39784",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/39784"
            },
            {
              "name": "USN-940-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/USN-940-1"
            },
            {
              "name": "SUSE-SR:2008:002",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/suse_security_summary_report.html"
            },
            {
              "name": "26750",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/26750"
            },
            {
              "name": "20071208 Venustech reports of MIT krb5 vulns [CVE-2007-5894 CVE-2007-5901 CVE-2007-5902 CVE-2007-5971 CVE-2007-5972]",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2007/Dec/0321.html"
            },
            {
              "name": "ADV-2010-1192",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2010/1192"
            },
            {
              "name": "44747",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/44747"
            },
            {
              "name": "20071208 MIT Kerberos 5: Multiple vulnerabilities",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2007/Dec/0176.html"
            },
            {
              "name": "39290",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/39290"
            },
            {
              "name": "USN-924-1",
              "refsource": "UBUNTU",
              "url": "http://ubuntu.com/usn/usn-924-1"
            },
            {
              "name": "28636",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28636"
            },
            {
              "name": "http://bugs.gentoo.org/show_bug.cgi?id=199211",
              "refsource": "MISC",
              "url": "http://bugs.gentoo.org/show_bug.cgi?id=199211"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-2012",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-2012"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-5972",
    "datePublished": "2007-12-06T02:00:00",
    "dateReserved": "2007-11-14T00:00:00",
    "dateUpdated": "2024-08-07T15:47:00.635Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted