CVE-2005-1689
CRITICAL severity · CVSS 9.8 · Double free
9.8CVSS CRITICAL
Summary
Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)11%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: http://marc.info/?l=bugtraq&m=112119974704542&w=2 ↗
Additional information
- NVD record
- http://marc.info/?l=bugtraq&m=112119974704542&w=2Patch
- http://secunia.com/advisories/16041Advisory
- http://secunia.com/advisories/17135Advisory
- http://secunia.com/advisories/17899Advisory
- ftp://patches.sgi.com/support/free/security/advisories/20050703-01-U.asc
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000993
- http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.html
- http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.html