CVE-2006-6144 Use after free in n/a
Remote attackers can crash the Kerberos administration daemon by triggering a use-after-free vulnerability in the GSS-API mechglue interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-6144?
CVE-2006-6144 is a medium-severity use after free vulnerability in Mit Kerberos 5, published on 10 Jan 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The "mechglue" abstraction interface of the GSS-API library for Kerberos 5 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, allows remote attackers to cause a denial of service (crash) via unspecified vectors that cause mechglue to free uninitialized pointers.
Which versions are affected by CVE-2006-6144?
It affects 1 product.
Products include Mit Kerberos 5.
How do I fix CVE-2006-6144?
Upgrade to a fixed version.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2006-6144 being exploited?
There is no known exploitation of CVE-2006-6144 in the wild and no public exploit code.
Other vulnerabilities in Mit Kerberos 5
Sources
Also known as GHSA-vm45-rfxq-cf44.