The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors. NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used. NOTE: the vendor disputes this issue, stating " The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.
CVE-2007-5894
CVSS base score
9.3 (v2.0)
Severity
HIGH
Attack vector
Network
Last modified
November 6, 2026
CVSS vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
Affected products
mit kerberos 5
References
- bugs.gentoo.org Issue Tracking, Mailing List, Third Party Advisory
- osvdb.org Broken Link
- seclists.org Mailing List
- seclists.org Mailing List
- secunia.com Vendor Advisory, Broken Link
- secunia.com Vendor Advisory, Broken Link
- wiki.rpath.com Broken Link
- wiki.rpath.com Broken Link
- www.novell.com Broken Link
- www.securityfocus.com Broken Link