CVE-2007-1216

描述

Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".

如何修補 CVE-2007-1216

要修補 CVE-2007-1216,請將受影響套件升級到下列已修補版本。

• Debian/krb5—升級至 1.4.4-8 或更新版本

CVE-2007-1216 正在被利用嗎?

中等 — EPSS 為 9.9%,可持續追蹤但非最高優先。

受影響套件(1)

• from 0, < 1.4.4-8

參考連結(1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2007-1216