CVE-2008-0063

Publication date 19 March 2008

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Cvss 3 Severity Score

7.5 · High

Score breakdown

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

Status

Package Ubuntu Release Status
krb5 7.10 gutsy
Fixed 1.6.dfsg.1-7ubuntu0.1
7.04 feisty
Fixed 1.4.4-5ubuntu3.4
6.10 edgy
Fixed 1.4.3-9ubuntu1.6
6.06 LTS dapper
Fixed 1.4.3-5ubuntu0.7

Severity score breakdown

Parameter Value
Base score 7.5 · High
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact None
Availability impact None
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Related Ubuntu Security Notices (USN)

    • USN-587-1
    • Kerberos vulnerabilities
    • 19 March 2008

Other references