CVE-2007-3149
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can...
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."
Exploit likelihood
What each source reports
NVD Score used
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."
- Record
CVE-2007-3149- CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."
- Record
CVE-2007-3149- Updated
- 2026-11-02
EUVDEUVD-2007-3141 No score
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."
- Record
EUVD-2007-3141- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-76wc-mqwv-wjv2 No score
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can...
sudo, when linked with MIT Kerberos 5 (krb5), does not properly check whether a user can currently authenticate to Kerberos, which allows local users to gain privileges, in a manner unintended by the sudo security model, via certain KRB5_ environment variable settings. NOTE: another researcher disputes this vulnerability, stating that the attacker must be "a user, who can already log into your system, and can already use sudo."
- Record
GHSA-76wc-mqwv-wjv2- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, references, title | GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-3149 is a high vulnerability (CVSS 7.2) in Mit Kerberos 5, published June 11, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. No source names a fixed version.
References
securityfocus.com/bid/24368
sudo.ws/cgi-bin/cvsweb/sudo/auth/kerb5.c
secunia.com/advisories/26540
nvd.nist.gov/vuln/detail/CVE-2007-3149
github.com/advisories/GHSA-76wc-mqwv-wjv2