CVE-2007-4000
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos...
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
Exploit likelihood
What each source reports
NVD Score used
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
- Record
CVE-2007-4000- CVSS 2.0
- 8.5 High
AV:N/AC:M/Au:S/C:C/I:C/A:C - Weakness
- CWE-824
- Updated
- 2026-11-02
CVE List No score
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
- Record
CVE-2007-4000- Updated
- 2026-11-02
EUVDEUVD-2007-3984 No score
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
- Record
EUVD-2007-3984- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rjp4-vqhr-2249 No score
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos...
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
- Record
GHSA-rjp4-vqhr-2249- Weakness
- CWE-824
- Updated
- 2026-11-02
OSV No score
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
- Record
CVE-2007-4000- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4000 No score
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
- Record
DEBIAN-CVE-2007-4000- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10899-1 No score
krb5-1.19.2-2.2 on GA media
These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10899-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 |
before 1.6.dfsg.1-7 | 1.6.dfsg.1-7 |
krb5Debian:13 |
before 1.6.dfsg.1-7 | 1.6.dfsg.1-7 |
krb5Debian:14 |
before 1.6.dfsg.1-7 | 1.6.dfsg.1-7 |
krb5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-libsRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
krb5-workstationRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-libsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-serverRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5-workstationRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.5-29 | 0:1.5-29 |
krb5openSUSE:Tumbleweed From an advisory covering 20 CVEs |
before 1.19.2-2.2 | 1.19.2-2.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4000 is a high vulnerability (CVSS 8.5) in Mit Kerberos 5, published September 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.14%, the 93rd percentile. Fixed in krb5 1.6.dfsg.1-7.
References
gentoo.org/security/en/glsa/glsa-200709-01.xml
redhat.com/archives/fedora-package-announce/2007-September/msg00087.html
novell.com/linux/security/advisories/2007_19_sr.html
issues.rpath.com/browse/RPL-1696
secunia.com/advisories/26680
Show 48 moreShow less
securitytracker.com/id?1018647
vupen.com/english/advisories/2007/3051
securityfocus.com/bid/25533
bugzilla.redhat.com/show_bug.cgi?id=250976
exchange.xforce.ibmcloud.com/vulnerabilities/36438
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9278
kb.cert.org/vuls/id/377544
web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt
securityreason.com/securityalert/3092
mandriva.com/security/advisories?name=MDKSA-2007:174
nvd.nist.gov/vuln/detail/CVE-2007-4000
github.com/advisories/GHSA-rjp4-vqhr-2249
security-tracker.debian.org/tracker/CVE-2007-4000
access.redhat.com/errata/RHSA-2007:0858
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0858.json
cve.org/CVERecord?id=CVE-2007-3999
suse.com/security/cve/CVE-2006-6143