CVE-2007-5902 Integer overflow in n/a
Remote attackers can trigger an integer overflow in MIT Kerberos 5 via a large GSS client name length in RPC requests, potentially causing undefined behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-5902?
CVE-2007-5902 is a critical vulnerability in Mit Kerberos 5, published on 6 Dec 2007. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Integer overflow in the svcauth_gss_get_principal function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (krb5) allows remote attackers to have an unknown impact via a large length value for a GSS client name in an RPC request.
Weakness: CWE-189
Which versions are affected by CVE-2007-5902?
It affects 1 product.
Products include Mit Kerberos 5.
How do I fix CVE-2007-5902?
Upgrade to a fixed version.
Is CVE-2007-5902 being exploited?
There is no known exploitation of CVE-2007-5902 in the wild and no public exploit code.
Other vulnerabilities in Mit Kerberos 5
Sources
Also known as DEBIAN-CVE-2007-5902, GHSA-p6m7-52v7-q7mq.