cvelistv5 - cve-2006-6143

CVE-2006-6143 (GCVE-0-2006-6143)

Vulnerability from cvelistv5

Published

2007-01-10 00:00

Modified

2024-08-07 20:19

Severity ?

CWE

Summary

The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

References

URL

Tags

	http://securitytracker.com/id?1017493	vdb-entry, x_refsource_SECTRACK
	http://fedoranews.org/cms/node/2376	vendor-advisory, x_refsource_FEDORA
	http://osvdb.org/31281	vdb-entry, x_refsource_OSVDB
	http://secunia.com/advisories/24966	third-party-advisory, x_refsource_SECUNIA
	http://www.kb.cert.org/vuls/id/481564	third-party-advisory, x_refsource_CERT-VN
	http://www.ubuntu.com/usn/usn-408-1	vendor-advisory, x_refsource_UBUNTU
	http://www.us-cert.gov/cas/techalerts/TA07-009B.html	third-party-advisory, x_refsource_CERT
	http://secunia.com/advisories/23696	third-party-advisory, x_refsource_SECUNIA
	http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html	vendor-advisory, x_refsource_SUSE
	http://docs.info.apple.com/article.html?artnum=305391	x_refsource_CONFIRM
	http://secunia.com/advisories/23706	third-party-advisory, x_refsource_SECUNIA
	http://www.mandriva.com/security/advisories?name=MDKSA-2007:008	vendor-advisory, x_refsource_MANDRIVA
	http://secunia.com/advisories/23903	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/21970	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/23667	third-party-advisory, x_refsource_SECUNIA
	http://security.gentoo.org/glsa/glsa-200701-21.xml	vendor-advisory, x_refsource_GENTOO
	http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt	x_refsource_CONFIRM
	http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html	vendor-advisory, x_refsource_OPENPKG
	http://fedoranews.org/cms/node/2375	vendor-advisory, x_refsource_FEDORA
	http://www.us-cert.gov/cas/techalerts/TA07-109A.html	third-party-advisory, x_refsource_CERT
	https://issues.rpath.com/browse/RPL-925	x_refsource_CONFIRM
	http://secunia.com/advisories/23707	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2007/0111	vdb-entry, x_refsource_VUPEN
	http://www.securityfocus.com/archive/1/456406/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/23772	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/23701	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://www.vupen.com/english/advisories/2007/1470	vdb-entry, x_refsource_VUPEN
	https://exchange.xforce.ibmcloud.com/vulnerabilities/31422	vdb-entry, x_refsource_XF

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:19:34.415Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1017493",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017493"
          },
          {
            "name": "FEDORA-2007-034",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://fedoranews.org/cms/node/2376"
          },
          {
            "name": "31281",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/31281"
          },
          {
            "name": "24966",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24966"
          },
          {
            "name": "VU#481564",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/481564"
          },
          {
            "name": "USN-408-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-408-1"
          },
          {
            "name": "TA07-009B",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html"
          },
          {
            "name": "23696",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23696"
          },
          {
            "name": "SUSE-SA:2007:004",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=305391"
          },
          {
            "name": "23706",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23706"
          },
          {
            "name": "MDKSA-2007:008",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:008"
          },
          {
            "name": "23903",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23903"
          },
          {
            "name": "21970",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21970"
          },
          {
            "name": "23667",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23667"
          },
          {
            "name": "GLSA-200701-21",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt"
          },
          {
            "name": "OpenPKG-SA-2007.006",
            "tags": [
              "vendor-advisory",
              "x_refsource_OPENPKG",
              "x_transferred"
            ],
            "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html"
          },
          {
            "name": "FEDORA-2007-033",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "http://fedoranews.org/cms/node/2375"
          },
          {
            "name": "TA07-109A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-109A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.rpath.com/browse/RPL-925"
          },
          {
            "name": "23707",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23707"
          },
          {
            "name": "ADV-2007-0111",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/0111"
          },
          {
            "name": "20070109 MITKRB5-SA-2006-002: kadmind (via RPC lib) calls uninitialized function pointer",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/456406/100/0/threaded"
          },
          {
            "name": "23772",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23772"
          },
          {
            "name": "23701",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23701"
          },
          {
            "name": "APPLE-SA-2007-04-19",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html"
          },
          {
            "name": "ADV-2007-1470",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/1470"
          },
          {
            "name": "kerberos-rpc-code-execution(31422)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31422"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-01-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "1017493",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017493"
        },
        {
          "name": "FEDORA-2007-034",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://fedoranews.org/cms/node/2376"
        },
        {
          "name": "31281",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/31281"
        },
        {
          "name": "24966",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24966"
        },
        {
          "name": "VU#481564",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/481564"
        },
        {
          "name": "USN-408-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-408-1"
        },
        {
          "name": "TA07-009B",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html"
        },
        {
          "name": "23696",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23696"
        },
        {
          "name": "SUSE-SA:2007:004",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=305391"
        },
        {
          "name": "23706",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23706"
        },
        {
          "name": "MDKSA-2007:008",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:008"
        },
        {
          "name": "23903",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23903"
        },
        {
          "name": "21970",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21970"
        },
        {
          "name": "23667",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23667"
        },
        {
          "name": "GLSA-200701-21",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt"
        },
        {
          "name": "OpenPKG-SA-2007.006",
          "tags": [
            "vendor-advisory",
            "x_refsource_OPENPKG"
          ],
          "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html"
        },
        {
          "name": "FEDORA-2007-033",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "http://fedoranews.org/cms/node/2375"
        },
        {
          "name": "TA07-109A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA07-109A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.rpath.com/browse/RPL-925"
        },
        {
          "name": "23707",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23707"
        },
        {
          "name": "ADV-2007-0111",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/0111"
        },
        {
          "name": "20070109 MITKRB5-SA-2006-002: kadmind (via RPC lib) calls uninitialized function pointer",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/456406/100/0/threaded"
        },
        {
          "name": "23772",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23772"
        },
        {
          "name": "23701",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23701"
        },
        {
          "name": "APPLE-SA-2007-04-19",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html"
        },
        {
          "name": "ADV-2007-1470",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/1470"
        },
        {
          "name": "kerberos-rpc-code-execution(31422)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31422"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-6143",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1017493",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017493"
            },
            {
              "name": "FEDORA-2007-034",
              "refsource": "FEDORA",
              "url": "http://fedoranews.org/cms/node/2376"
            },
            {
              "name": "31281",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/31281"
            },
            {
              "name": "24966",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/24966"
            },
            {
              "name": "VU#481564",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/481564"
            },
            {
              "name": "USN-408-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-408-1"
            },
            {
              "name": "TA07-009B",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-009B.html"
            },
            {
              "name": "23696",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23696"
            },
            {
              "name": "SUSE-SA:2007:004",
              "refsource": "SUSE",
              "url": "http://lists.suse.com/archive/suse-security-announce/2007-Jan/0004.html"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=305391",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=305391"
            },
            {
              "name": "23706",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23706"
            },
            {
              "name": "MDKSA-2007:008",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:008"
            },
            {
              "name": "23903",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23903"
            },
            {
              "name": "21970",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21970"
            },
            {
              "name": "23667",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23667"
            },
            {
              "name": "GLSA-200701-21",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200701-21.xml"
            },
            {
              "name": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt",
              "refsource": "CONFIRM",
              "url": "http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt"
            },
            {
              "name": "OpenPKG-SA-2007.006",
              "refsource": "OPENPKG",
              "url": "http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.006.html"
            },
            {
              "name": "FEDORA-2007-033",
              "refsource": "FEDORA",
              "url": "http://fedoranews.org/cms/node/2375"
            },
            {
              "name": "TA07-109A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-109A.html"
            },
            {
              "name": "https://issues.rpath.com/browse/RPL-925",
              "refsource": "CONFIRM",
              "url": "https://issues.rpath.com/browse/RPL-925"
            },
            {
              "name": "23707",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23707"
            },
            {
              "name": "ADV-2007-0111",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/0111"
            },
            {
              "name": "20070109 MITKRB5-SA-2006-002: kadmind (via RPC lib) calls uninitialized function pointer",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/456406/100/0/threaded"
            },
            {
              "name": "23772",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23772"
            },
            {
              "name": "23701",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23701"
            },
            {
              "name": "APPLE-SA-2007-04-19",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html"
            },
            {
              "name": "ADV-2007-1470",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/1470"
            },
            {
              "name": "kerberos-rpc-code-execution(31422)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31422"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-6143",
    "datePublished": "2007-01-10T00:00:00.000Z",
    "dateReserved": "2006-11-28T00:00:00.000Z",
    "dateUpdated": "2024-08-07T20:19:34.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CERTA-2007-AVI-185

Vulnerability from certfr_avis

Plusieurs vulnérabilités sous Apple MacOS X permettent à un utilisateur malveillant de compromettre un système vulnérable, localement ou à distance.

Description

Plusieurs vulnérabilités sont présentes sous Apple MacOS X :

une vulnérabilité du client AFP permet à un utilisateur local de créer des fichiers ou d'exécuter des commandes avec les privilèges système ;
une vulnérabilité dans Airport de type débordement de mémoire permettrait l'exécution d'un code arbitraire avec des privilèges élevés ;
une vulnérabilité de CarbonCore permet l'exécution d'un code arbitraire avec des privilèges élevés ;
une vulnérabilité dans fsck permet à un utilisateur d'exécuter du code arbitraire à distance en incitant un utilisateur à charger un fichier image (.dmg) spécialement conçu;
une vulnérabilité dans fetchmail provoque l'envoi d'informations d'authentification en clair, même lorsque la configuration exige l'utilisation de TLS ;
un débordement de mémoire dans ftpd permet à un utilisateur authentifié d'exécuter un code arbitraire à distance ;
une mauvaise gestion de format dans Help Viewer et un débordement de mémoire dans GNU Tar permettent à un utilisateur malintentionné de provoquer un arrêt inopiné de l'application ou d'exécuter du code arbitraire ;
un contrôle insuffisant dans HID permet à un utilisateur malveillant de capturer les entrées au clavier, y compris les données sensibles ;
une erreur de gestion de format dans Installer permet à un utilisateur malintentionné de provoquer un arrêt inopiné de l'application ou d'exécuter du code arbitraire à distance ;
une erreur dans WebFoundation permet à un domaine parent de lire un cookie positionné par l'un de ses sous-domaines ;
le défaut de gestion de l'environnement par WebDav permet à un utilisateur local malintentionné de créer des fichiers ou d'exécuter des commandes avec les privilèges système ;
un défaut de validation des paquets SIP par Videoconference permet à un utilisateur malintentionné d'exécuter un code arbitraire à distance ;
URLMount monte des systèmes de fichiers distants via un serveur SMB en appelant la commande mount_smb ; Les identifiants et les mots de passe sont transmis comme arguments en ligne de commande, ce qui les expose à être divulgués à d'autres utilisateurs ;
un manque de contrôle dans launchctl permet aux administrateurs locaux de lancer des commandes avec les privilèges système sans s'authentifier ;
le défaut de gestion de l'environnement par le serveur SMB permettrait à un utilisateur local malintentionné de créer des fichiers ou d'exécuter des commandes avec les privilèges système ;
lorsque le partage Internet Sharing est actif, un mauvais traitement de paquets RTSP permet à un utilisateur mal intentionné de provoquer un déni de service ou l'exécution de code arbitraire à distance ;
des erreurs dans Login Window permettent à un utilisateur local de se connecter sans authentification ou d'élever ses privilèges ;
des erreurs dans Libinfo permettent à un utilisateur malintentionné de provoquer un déni de service ou d'exécuter du code arbitraire à distance ;
des vulnérabilités dans le démon d'administration de Kerberos permettent à un utilisateur malintentionné de provoquer un arrêt inopiné de l'application ou l'exécution de code arbitraire avec les droits système.

Apple a publié le 01 mai 2007 deux mises à jour de correctifs. La première concerne les pilotes sans-fil Airport pour Mac OS X v10.3.9, et la seconde le serveur FTP FTPServer sous Mac OS X v10.4.9. Le précédent correctif applique un fichier de configuration FTP incorrect, qui permettrait aux utilisateurs d'accéder illégitimement à certains répertoires.

Solution

Appliquer la mise à jour de sécurité 2007-004., ainsi que le correctif de cette mise à jour (v1.1). Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Apple	macOS	Apple MacOS X server version 10.3.x et 10.4.x.
	Apple	macOS	Apple MacOS X version 10.3.x et 10.4.x ;

References

Title

Publication Time

Tags

Bulletin de mise à jour Apple	None	vendor-advisory
Bulletin de sécurité Apple du 19 avril 2007 :	-	other
Mise à jour du bulletin précédent, faite le 01 mai 2007 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Apple MacOS X server version 10.3.x et 10.4.x.",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    },
    {
      "description": "Apple MacOS X version 10.3.x et 10.4.x ;",
      "product": {
        "name": "macOS",
        "vendor": {
          "name": "Apple",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s sont pr\u00e9sentes sous Apple MacOS X :\n\n-   une vuln\u00e9rabilit\u00e9 du client AFP permet \u00e0 un utilisateur local de\n    cr\u00e9er des fichiers ou d\u0027ex\u00e9cuter des commandes avec les privil\u00e8ges\n    syst\u00e8me ;\n-   une vuln\u00e9rabilit\u00e9 dans Airport de type d\u00e9bordement de m\u00e9moire\n    permettrait l\u0027ex\u00e9cution d\u0027un code arbitraire avec des privil\u00e8ges\n    \u00e9lev\u00e9s ;\n-   une vuln\u00e9rabilit\u00e9 de CarbonCore permet l\u0027ex\u00e9cution d\u0027un code\n    arbitraire avec des privil\u00e8ges \u00e9lev\u00e9s ;\n-   une vuln\u00e9rabilit\u00e9 dans fsck permet \u00e0 un utilisateur d\u0027ex\u00e9cuter du\n    code arbitraire \u00e0 distance en incitant un utilisateur \u00e0 charger un\n    fichier image (.dmg) sp\u00e9cialement con\u00e7u;\n-   une vuln\u00e9rabilit\u00e9 dans fetchmail provoque l\u0027envoi d\u0027informations\n    d\u0027authentification en clair, m\u00eame lorsque la configuration exige\n    l\u0027utilisation de TLS ;\n-   un d\u00e9bordement de m\u00e9moire dans ftpd permet \u00e0 un utilisateur\n    authentifi\u00e9 d\u0027ex\u00e9cuter un code arbitraire \u00e0 distance ;\n-   une mauvaise gestion de format dans Help Viewer et un d\u00e9bordement de\n    m\u00e9moire dans GNU Tar permettent \u00e0 un utilisateur malintentionn\u00e9 de\n    provoquer un arr\u00eat inopin\u00e9 de l\u0027application ou d\u0027ex\u00e9cuter du code\n    arbitraire ;\n-   un contr\u00f4le insuffisant dans HID permet \u00e0 un utilisateur malveillant\n    de capturer les entr\u00e9es au clavier, y compris les donn\u00e9es sensibles\n    ;\n-   une erreur de gestion de format dans Installer permet \u00e0 un\n    utilisateur malintentionn\u00e9 de provoquer un arr\u00eat inopin\u00e9 de\n    l\u0027application ou d\u0027ex\u00e9cuter du code arbitraire \u00e0 distance ;\n-   une erreur dans WebFoundation permet \u00e0 un domaine parent de lire un\n    cookie positionn\u00e9 par l\u0027un de ses sous-domaines ;\n-   le d\u00e9faut de gestion de l\u0027environnement par WebDav permet \u00e0 un\n    utilisateur local malintentionn\u00e9 de cr\u00e9er des fichiers ou d\u0027ex\u00e9cuter\n    des commandes avec les privil\u00e8ges syst\u00e8me ;\n-   un d\u00e9faut de validation des paquets SIP par Videoconference permet \u00e0\n    un utilisateur malintentionn\u00e9 d\u0027ex\u00e9cuter un code arbitraire \u00e0\n    distance ;\n-   URLMount monte des syst\u00e8mes de fichiers distants via un serveur SMB\n    en appelant la commande mount_smb ; Les identifiants et les mots de\n    passe sont transmis comme arguments en ligne de commande, ce qui les\n    expose \u00e0 \u00eatre divulgu\u00e9s \u00e0 d\u0027autres utilisateurs ;\n-   un manque de contr\u00f4le dans launchctl permet aux administrateurs\n    locaux de lancer des commandes avec les privil\u00e8ges syst\u00e8me sans\n    s\u0027authentifier ;\n-   le d\u00e9faut de gestion de l\u0027environnement par le serveur SMB\n    permettrait \u00e0 un utilisateur local malintentionn\u00e9 de cr\u00e9er des\n    fichiers ou d\u0027ex\u00e9cuter des commandes avec les privil\u00e8ges syst\u00e8me ;\n-   lorsque le partage Internet Sharing est actif, un mauvais traitement\n    de paquets RTSP permet \u00e0 un utilisateur mal intentionn\u00e9 de provoquer\n    un d\u00e9ni de service ou l\u0027ex\u00e9cution de code arbitraire \u00e0 distance ;\n-   des erreurs dans Login Window permettent \u00e0 un utilisateur local de\n    se connecter sans authentification ou d\u0027\u00e9lever ses privil\u00e8ges ;\n-   des erreurs dans Libinfo permettent \u00e0 un utilisateur malintentionn\u00e9\n    de provoquer un d\u00e9ni de service ou d\u0027ex\u00e9cuter du code arbitraire \u00e0\n    distance ;\n-   des vuln\u00e9rabilit\u00e9s dans le d\u00e9mon d\u0027administration de Kerberos\n    permettent \u00e0 un utilisateur malintentionn\u00e9 de provoquer un arr\u00eat\n    inopin\u00e9 de l\u0027application ou l\u0027ex\u00e9cution de code arbitraire avec les\n    droits syst\u00e8me.\n\nApple a publi\u00e9 le 01 mai 2007 deux mises \u00e0 jour de correctifs. La\npremi\u00e8re concerne les pilotes sans-fil Airport pour Mac OS X v10.3.9, et\nla seconde le serveur FTP FTPServer sous Mac OS X v10.4.9. Le pr\u00e9c\u00e9dent\ncorrectif applique un fichier de configuration FTP incorrect, qui\npermettrait aux utilisateurs d\u0027acc\u00e9der ill\u00e9gitimement \u00e0 certains\nr\u00e9pertoires.\n\n## Solution\n\nAppliquer la mise \u00e0 jour de s\u00e9curit\u00e9 2007-004., ainsi que le correctif\nde cette mise \u00e0 jour (v1.1). Se r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de\nl\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2007-0744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0744"
    },
    {
      "name": "CVE-2007-0646",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0646"
    },
    {
      "name": "CVE-2007-0732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0732"
    },
    {
      "name": "CVE-2007-0738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0738"
    },
    {
      "name": "CVE-2006-5867",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-5867"
    },
    {
      "name": "CVE-2007-0741",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0741"
    },
    {
      "name": "CVE-2007-0957",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0957"
    },
    {
      "name": "CVE-2007-0742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0742"
    },
    {
      "name": "CVE-2007-0729",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0729"
    },
    {
      "name": "CVE-2007-0743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0743"
    },
    {
      "name": "CVE-2007-0736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0736"
    },
    {
      "name": "CVE-2007-0465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0465"
    },
    {
      "name": "CVE-2007-0724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0724"
    },
    {
      "name": "CVE-2007-0739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0739"
    },
    {
      "name": "CVE-2007-1216",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-1216"
    },
    {
      "name": "CVE-2007-0734",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0734"
    },
    {
      "name": "CVE-2007-0746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0746"
    },
    {
      "name": "CVE-2007-0927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0927"
    },
    {
      "name": "CVE-2006-0300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-0300"
    },
    {
      "name": "CVE-2007-0745",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0745"
    },
    {
      "name": "CVE-2007-0725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0725"
    },
    {
      "name": "CVE-2007-0747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0747"
    },
    {
      "name": "CVE-2007-0022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0022"
    },
    {
      "name": "CVE-2007-0735",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0735"
    },
    {
      "name": "CVE-2007-0737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2007-0737"
    },
    {
      "name": "CVE-2006-6652",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6652"
    },
    {
      "name": "CVE-2006-6143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6143"
    }
  ],
  "initial_release_date": "2007-04-20T00:00:00",
  "last_revision_date": "2007-05-03T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Apple du 19 avril 2007 :",
      "url": "http://docs.info.apple.com/article.html?artnum=305391"
    },
    {
      "title": "Mise \u00e0 jour du bulletin pr\u00e9c\u00e9dent, faite le 01 mai 2007 :",
      "url": "http://docs.info.apple.com/article.html?artnum=305445"
    }
  ],
  "reference": "CERTA-2007-AVI-185",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-04-20T00:00:00.000000"
    },
    {
      "description": "ajout de la mise \u00e0 jour du bulletin d\u0027avril 2007, ainsi que la r\u00e9f\u00e9rence au CVE CVE-2007-0745.",
      "revision_date": "2007-05-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s sous \u003cspan class=\"textit\"\u003eApple MacOS X\u003c/span\u003e\npermettent \u00e0 un utilisateur malveillant de compromettre un syst\u00e8me\nvuln\u00e9rable, localement ou \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Apple MacOS X",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de mise \u00e0 jour Apple",
      "url": null
    }
  ]
}

CERTA-2007-AVI-019

Vulnerability from certfr_avis

Deux vulnérabilités découvertes dans kadmind permettent l'exécution de code arbitraire à distance.

Description

Deux vulnérabilités ont été découvertes dans kadmind.

La première est présente dans la partie serveur de la bibliothèque RPC. La seconde résulte de problèmes de gestion de la mémoire dans l'interface mechglue de la bibliothèque GSS-API. Un utilisateur malintentionné peut exploiter l'une de ces vulnérabilités, sans authentification préalable, pour exécuter du code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

kadmind versions krb5-1.4 à krb5-1.4.4 ;
kadmind versions krb5-1.5 à krb5-1.5.1 ;
toute application tiers utilisant les bibliothèques GSS-API et RPC incluses dans les versions krb5-1.4 à krb5-1.4.4 et krb5-1.5 à krb5-1.5.1.

Les versions de kadmind antérieures à krb5-1.4 ne sont pas affectées.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

Tags

Bulletin de sécurité MIT MITKRB5-SA-2006-002 du 09 janvier 2007	None	vendor-advisory
Bulletin de sécurité MIT MITKRB5-SA-2006-003 du 09 janvier 2007	None	vendor-advisory
Bulletin de sécurité MIT MITKRB5-SA-2006-002 du 09 janvier 2007 :	-	other
Bulletin de sécurité MIT MITKRB5-SA-2006-003 du 09 janvier 2007 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cUL\u003e    \u003cLI\u003e\u003cTT\u003ekadmind\u003c/TT\u003e versions krb5-1.4 \u00e0 krb5-1.4.4 ;\u003c/LI\u003e    \u003cLI\u003e\u003cTT\u003ekadmind\u003c/TT\u003e versions krb5-1.5 \u00e0 krb5-1.5.1 ;\u003c/LI\u003e    \u003cLI\u003etoute application tiers utilisant les biblioth\u00e8ques    \u003cTT\u003eGSS-API\u003c/TT\u003e et \u003cTT\u003eRPC\u003c/TT\u003e incluses dans les versions    krb5-1.4 \u00e0 krb5-1.4.4 et krb5-1.5 \u00e0 krb5-1.5.1.\u003c/LI\u003e  \u003c/UL\u003e  \u003cP\u003eLes versions de \u003cTT\u003ekadmind\u003c/TT\u003e ant\u00e9rieures \u00e0 krb5-1.4 ne  sont pas affect\u00e9es.\u003c/P\u003e",
  "content": "## Description\n\nDeux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans kadmind.\n\nLa premi\u00e8re est pr\u00e9sente dans la partie serveur de la biblioth\u00e8que RPC.\nLa seconde r\u00e9sulte de probl\u00e8mes de gestion de la m\u00e9moire dans\nl\u0027interface mechglue de la biblioth\u00e8que GSS-API. Un utilisateur\nmalintentionn\u00e9 peut exploiter l\u0027une de ces vuln\u00e9rabilit\u00e9s, sans\nauthentification pr\u00e9alable, pour ex\u00e9cuter du code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-6144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6144"
    },
    {
      "name": "CVE-2006-6143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-6143"
    }
  ],
  "initial_release_date": "2007-01-10T00:00:00",
  "last_revision_date": "2007-01-10T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 MIT MITKRB5-SA-2006-002 du 09 janvier    2007 :",
      "url": "http://web.mit.edu/kerberos/advisories/MITKRB-SA-2006-002-rpc.txt"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 MIT MITKRB5-SA-2006-003 du 09 janvier    2007 :",
      "url": "http://web.mit.edu/kerberos/advisories/MITKRB-SA-2006-003-mechglue.txt"
    }
  ],
  "reference": "CERTA-2007-AVI-019",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2007-01-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans kadmind permettent l\u0027ex\u00e9cution de\ncode arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Kerberos",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 MIT MITKRB5-SA-2006-002 du 09 janvier 2007",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 MIT MITKRB5-SA-2006-003 du 09 janvier 2007",
      "url": null
    }
  ]
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2006-6143 (GCVE-0-2006-6143)

Vulnerability from cvelistv5

CERTA-2007-AVI-185

Vulnerability from certfr_avis

Description

Solution

CERTA-2007-AVI-019

Vulnerability from certfr_avis

Description

Solution

Tags

Sightings

Nomenclature