Vulnerabilità: CVE-2007-2442

La funzione gssrpc__svcauth_gssapi nella libreria RPC in MIT Kerberos 5 (krb5) 1.6.1 e precedenti potrebbe permettere attaccanti remoti di eseguire codice arbitrario tramite credenziali RPC lunghezza zero, che provoca kadmind liberare un puntatore non inizializzato durante la pulizia.


http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
http://www.securityfocus.com/bid/24655
http://www.securityfocus.com/bid/25159
http://www.securityfocus.com/archive/1/472288/100/0/threaded
http://www.securityfocus.com/archive/1/472432/100/0/threaded
http://www.securityfocus.com/archive/1/472507/30/5970/threaded
http://www.us-cert.gov/cas/techalerts/TA07-177A.html
http://www.kb.cert.org/vuls/id/356961
http://docs.info.apple.com/article.html?artnum=306172
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-004.txt
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-004.txt
https://issues.rpath.com/browse/RPL-1499
https://secure-support.novell.com/KanisaPlatform/Publishing/773/3248163_f.SAL_Public.html
http://www.debian.org/security/2007/dsa-1323
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
http://security.gentoo.org/glsa/glsa-200707-11.xml
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
http://www.mandriva.com/security/advisories?name=MDKSA-2007:137
http://osvdb.org/36596
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10631
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7344
http://www.redhat.com/support/errata/RHSA-2007-0384.html
http://www.redhat.com/support/errata/RHSA-2007-0562.html
http://www.securitytracker.com/id?1018293
http://secunia.com/advisories/25800
http://secunia.com/advisories/25801
http://secunia.com/advisories/25814
http://secunia.com/advisories/25821
http://secunia.com/advisories/25841
http://secunia.com/advisories/25870
http://secunia.com/advisories/25888
http://secunia.com/advisories/25890
http://secunia.com/advisories/25894
http://secunia.com/advisories/25911
http://secunia.com/advisories/26033
http://secunia.com/advisories/26228
http://secunia.com/advisories/26235
http://secunia.com/advisories/26909
http://secunia.com/advisories/27706
http://secunia.com/advisories/40346
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102914-1
http://www.novell.com/linux/security/advisories/2007_38_krb5.html
http://www.trustix.org/errata/2007/0021/
http://www.ubuntu.com/usn/usn-477-1
http://www.vupen.com/english/advisories/2007/2337
http://www.vupen.com/english/advisories/2007/2354
http://www.vupen.com/english/advisories/2007/2491
http://www.vupen.com/english/advisories/2007/2732
http://www.vupen.com/english/advisories/2007/3229
http://www.vupen.com/english/advisories/2010/1574
https://exchange.xforce.ibmcloud.com/vulnerabilities/35082
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2442


E' possibile lasciare un commento come utenti registrati al sito, accedendo tramite social, account wordpress oppure come utenti anonimi. Nel caso in cui si desideri lasciare un commento come utenti anonimi si verrà avvisati via email di un'eventuale risposta solo se si inserisce l'indirizzo email (facoltativo). L'inserimento di qualsiasi dato nei campi dei commenti è totalmente facoltativo. Chiunque decida di inserire un qualsiasi dato accetta il trattamento di questi ultimi per i fini inerenti al servizio ovvero la risposta al commento e le comunicazioni strettamente necessarie.


Rispondi