Unscored severity · published Sep 5, 2007
CVE-2007-4000
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not…
–
CVSS
6.1%
EPSS
No
On KEV
Description
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.1% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
7 · source: NVD
K5
Kerberos 5 · Mit
1.5 through 1.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4000
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4000
Broken Link
http://secunia.com/advisories/26676
Broken Link
http://secunia.com/advisories/26680
Broken Link
http://secunia.com/advisories/26700
Broken Link
http://secunia.com/advisories/26728
Broken Link
http://secunia.com/advisories/26783
Broken Link
http://secunia.com/advisories/26987
More from Fedora
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2024-4577
Argument Injection in PHP-CGI
9.8
CVE-2021-44026
Roundcube Webmail SQL Injection Vulnerability
9.8
CVE-2021-42013
Path Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)