CVE Feed

    Dashboard / CVE / CVE-2007-3999

    CVE-2007-3999

    Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.

    Published:Sep 4, 2007
    Last Modified:Apr 23, 2026
    EPS:Sep 5, 2007
    EPSS Score:0.46976
    CVSS Score:10

    Affected Products

    Vendor
    Mit
    Product
    Kerberos 5
    Vendor
    Redhat
    Product
    Enterprise Linux

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-40356 (CVSS 5.9) — In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if …
    CVE-2026-40355 (CVSS 5.9) — In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_ac…
    CVE-2024-37370 (CVSS 7.5) — In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confid…
    CVE-2024-37371 (CVSS 9.1) — In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message toke…
    CVE-2024-26462 (CVSS 5.5) — Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.…
    CVE-2024-26461 (CVSS 7.5) — Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.…
    CVE-2024-26458 (CVSS 5.3) — Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.…
    CVE-2025-24528 (CVSS 7.1) — In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a la…
    CVE-2023-39975 (CVSS 8.8) — kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an aut…
    CVE-2023-36054 (CVSS 6.5) — lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitia…

    References

    http://docs.info.apple.com/article.html?artnum=307041
    http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
    http://lists.rpath.com/pipermail/security-announce/2007-September/000237.html
    http://secunia.com/advisories/26676
    http://secunia.com/advisories/26680
    http://secunia.com/advisories/26684
    http://secunia.com/advisories/26691
    http://secunia.com/advisories/26697
    http://secunia.com/advisories/26699
    http://secunia.com/advisories/26700
    http://secunia.com/advisories/26705
    http://secunia.com/advisories/26713
    http://secunia.com/advisories/26728
    http://secunia.com/advisories/26783
    http://secunia.com/advisories/26792
    http://secunia.com/advisories/26822
    http://secunia.com/advisories/26896
    http://secunia.com/advisories/26987
    http://secunia.com/advisories/27043
    http://secunia.com/advisories/27081
    http://secunia.com/advisories/27146
    http://secunia.com/advisories/27643
    http://secunia.com/advisories/27756
    http://secunia.com/advisories/29247
    http://secunia.com/advisories/29270
    http://security.gentoo.org/glsa/glsa-200710-01.xml
    http://securityreason.com/securityalert/3092
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-103060-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-201319-1
    http://support.avaya.com/elmodocs2/security/ASA-2007-396.htm
    http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt
    http://www.debian.org/security/2007/dsa-1367
    http://www.debian.org/security/2007/dsa-1368
    http://www.gentoo.org/security/en/glsa/glsa-200709-01.xml
    http://www.kb.cert.org/vuls/id/883632
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:174
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:181
    http://www.novell.com/linux/security/advisories/2007_19_sr.html
    http://www.novell.com/linux/security/advisories/2007_24_sr.html
    http://www.redhat.com/support/errata/RHSA-2007-0858.html
    http://www.redhat.com/support/errata/RHSA-2007-0913.html
    http://www.redhat.com/support/errata/RHSA-2007-0951.html
    http://www.securityfocus.com/archive/1/478748/100/0/threaded
    http://www.securityfocus.com/archive/1/479251/100/0/threaded
    http://www.securityfocus.com/bid/25534
    http://www.securityfocus.com/bid/26444
    http://www.securitytracker.com/id?1018647
    http://www.trustix.org/errata/2007/0026/
    http://www.ubuntu.com/usn/usn-511-1
    http://www.us-cert.gov/cas/techalerts/TA07-319A.html
    http://www.vupen.com/english/advisories/2007/3051
    http://www.vupen.com/english/advisories/2007/3052
    http://www.vupen.com/english/advisories/2007/3060
    http://www.vupen.com/english/advisories/2007/3868
    http://www.vupen.com/english/advisories/2008/0803/references
    http://www.zerodayinitiative.com/advisories/ZDI-07-052.html
    https://bugzilla.redhat.com/show_bug.cgi?id=250973
    https://exchange.xforce.ibmcloud.com/vulnerabilities/36437
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3162
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9379
    https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00087.html
    https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00173.html
    http://docs.info.apple.com/article.html?artnum=307041
    http://lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
    http://lists.rpath.com/pipermail/security-announce/2007-September/000237.html
    http://secunia.com/advisories/26676
    http://secunia.com/advisories/26680
    http://secunia.com/advisories/26684
    http://secunia.com/advisories/26691
    http://secunia.com/advisories/26697
    http://secunia.com/advisories/26699
    http://secunia.com/advisories/26700
    http://secunia.com/advisories/26705
    http://secunia.com/advisories/26713
    http://secunia.com/advisories/26728
    http://secunia.com/advisories/26783
    http://secunia.com/advisories/26792
    http://secunia.com/advisories/26822
    http://secunia.com/advisories/26896
    http://secunia.com/advisories/26987
    http://secunia.com/advisories/27043
    http://secunia.com/advisories/27081
    http://secunia.com/advisories/27146
    http://secunia.com/advisories/27643
    http://secunia.com/advisories/27756
    http://secunia.com/advisories/29247
    http://secunia.com/advisories/29270
    http://security.gentoo.org/glsa/glsa-200710-01.xml
    http://securityreason.com/securityalert/3092
    http://sunsolve.sun.com/search/document.do?assetkey=1-26-103060-1
    http://sunsolve.sun.com/search/document.do?assetkey=1-66-201319-1
    http://support.avaya.com/elmodocs2/security/ASA-2007-396.htm
    http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt
    http://www.debian.org/security/2007/dsa-1367
    http://www.debian.org/security/2007/dsa-1368
    http://www.gentoo.org/security/en/glsa/glsa-200709-01.xml
    http://www.kb.cert.org/vuls/id/883632
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:174
    http://www.mandriva.com/security/advisories?name=MDKSA-2007:181
    http://www.novell.com/linux/security/advisories/2007_19_sr.html
    http://www.novell.com/linux/security/advisories/2007_24_sr.html
    http://www.redhat.com/support/errata/RHSA-2007-0858.html
    http://www.redhat.com/support/errata/RHSA-2007-0913.html
    http://www.redhat.com/support/errata/RHSA-2007-0951.html
    http://www.securityfocus.com/archive/1/478748/100/0/threaded
    http://www.securityfocus.com/archive/1/479251/100/0/threaded
    http://www.securityfocus.com/bid/25534
    http://www.securityfocus.com/bid/26444
    http://www.securitytracker.com/id?1018647
    http://www.trustix.org/errata/2007/0026/
    http://www.ubuntu.com/usn/usn-511-1
    http://www.us-cert.gov/cas/techalerts/TA07-319A.html
    http://www.vupen.com/english/advisories/2007/3051
    http://www.vupen.com/english/advisories/2007/3052
    http://www.vupen.com/english/advisories/2007/3060
    http://www.vupen.com/english/advisories/2007/3868
    http://www.vupen.com/english/advisories/2008/0803/references
    http://www.zerodayinitiative.com/advisories/ZDI-07-052.html
    https://bugzilla.redhat.com/show_bug.cgi?id=250973
    https://exchange.xforce.ibmcloud.com/vulnerabilities/36437
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3162
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9379
    https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00087.html
    https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00173.html

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High