CVE-2006-6144

Related Files

OpenPKG Security Advisory 2007.6

Posted Jan 13, 2007

Authored by OpenPKG Foundation | Site openpkg.com

OpenPKG Security Advisory - According to vendor security advisories, two security issues exist in the Kerberos network authentication system implementation MIT Kerberos. First, the RPC library could call an uninitialized function pointer, which created a security vulnerability for kadmind(8). Second, the GSS-API "mechglue" layer could fail to initialize some output pointers, causing callers to attempt to free uninitialized pointers. This caused another security vulnerability in kadmind(8).

tags | advisory

advisories | CVE-2006-6143, CVE-2006-6144

SHA-256 | 18eb84638a0aa1af34b0b1cdc4873ec6ac8264aa88bdd3cd284bf7eb213a80c4

Download | Favorite | View

MITKRB5-SA-2006-003.txt

Posted Jan 13, 2007

Site web.mit.edu

MIT krb5 Security Advisory 2006-003 - The Kerberos administration daemon, "kadmind", can free uninitialized pointers, possibly leading to arbitrary code execution. This vulnerability results from memory management bugs in the "mechglue" abstraction interface of the GSS-API implementation. Third-party applications written using the GSS-API may also be vulnerable.

tags | advisory, arbitrary, code execution

advisories | CVE-2006-6144

SHA-256 | fe0c7983abc6fcc874c2ddd78be53dfa71e11c82dac8f76ce5847d09a230d0cb

Download | Favorite | View