Overview
MIT Kerberos kadmind contains a privilege escalation vulnerability that may allow an authenticated attacker to execute code with root privileges.
Description
Kerberos is a network authentication system that uses a trusted third party to authenticate clients and servers to each other. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. MIT Kerberos code is used in network applications from a variety of different vendors and is included in many UNIX and Linux distributions. The kadmind daemon is the administration server that runs on the master Kerberos server. From the kadmind manual page: |
Impact
A local attacker, who has modify policy privileges, may be able to execute arbitrary code with elevated privileges |
Solution
Update |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
Thanks to the MIT Kerberos team for information that was used in this report.
This document was written by Ryan Giobbi.
Other Information
| CVE IDs: | CVE-2007-4000 |
| Severity Metric: | 0.63 |
| Date Public: | 2007-09-04 |
| Date First Published: | 2007-09-04 |
| Date Last Updated: | 2007-10-26 19:53 UTC |
| Document Revision: | 18 |