{"id":"CVE-2007-5894","aliases":["DEBIAN-CVE-2007-5894","EUVD-2007-5864","GHSA-jp3p-7xp7-3qgr","openSUSE-SU-2024:10899-1"],"status":"disputed","title":"** DISPUTED **  The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not...","description":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","severity":{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03276,"percentile":0.88505,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2007-12-06T02:00:00Z","modified":"2026-11-06T17:19:45Z","fixes":[{"ecosystem":"Debian:12","package":"krb5","fixed_in":["1.6.dfsg.4~beta1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"krb5","fixed_in":["1.6.dfsg.4~beta1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"krb5","fixed_in":["1.6.dfsg.4~beta1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.dfsg.4~beta1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.dfsg.4~beta1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.dfsg.4~beta1-1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-2.2"}]}],"bundled":20}],"products":[{"vendor":"mit","product":"kerberos_5"}],"references":[{"url":"http://secunia.com/advisories/29457","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","Broken Link","advisory"]},{"url":"http://www.novell.com/linux/security/advisories/suse_security_summary_report.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","advisory"]},{"url":"http://www.securityfocus.com/bid/26750","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2008-0112","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://seclists.org/fulldisclosure/2007/Dec/0321.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","web"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0112","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://www.securityfocus.com/archive/1/489883/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","web"]},{"url":"http://bugs.gentoo.org/show_bug.cgi?id=199205","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","web"]},{"url":"http://seclists.org/fulldisclosure/2007/Dec/0176.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","web"]},{"url":"http://osvdb.org/44333","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","Broken Link","web"]},{"url":"http://secunia.com/advisories/28636","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","Broken Link","advisory"]},{"url":"https://issues.rpath.com/browse/RPL-2012","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5894"},{"url":"https://github.com/advisories/GHSA-jp3p-7xp7-3qgr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2007-5894","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-3999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5729","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-37750","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2007-5894","description":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","status":"disputed","published":"2007-12-06T02:00:00Z","modified":"2024-08-07T15:47:00.553Z","updated_at":"2026-11-02T13:32:00.617893Z"}],"euvd":[{"id":"EUVD-2007-5864","description":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","status":"published","published":"2007-12-06T02:00:00Z","modified":"2024-08-07T15:47:00Z","updated_at":"2026-11-03T01:16:15.2541Z"}],"ghsa":[{"id":"GHSA-jp3p-7xp7-3qgr","title":"** DISPUTED **  The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not...","description":"** DISPUTED **  The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.\"","status":"published","published":"2022-05-01T18:37:36Z","modified":"2023-01-31T05:04:44Z","updated_at":"2026-11-02T14:48:43.49737Z"}],"nvd":[{"id":"CVE-2007-5894","description":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","status":"disputed","published":"2007-12-06T02:46:00Z","modified":"2026-11-06T17:19:45.163Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-06T20:01:08.914507Z"}],"osv":[{"id":"CVE-2007-5894","description":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","status":"published","published":"2007-12-06T02:46:00Z","modified":"2026-04-10T03:39:21.683973Z","updated_at":"2026-11-02T15:43:57.178433Z"},{"id":"DEBIAN-CVE-2007-5894","description":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","status":"published","published":"2007-12-06T02:46:00Z","modified":"2026-11-06T21:47:32.58457445Z","updated_at":"2026-11-06T22:24:36.872703Z"},{"id":"openSUSE-SU-2024:10899-1","title":"krb5-1.19.2-2.2 on GA media","description":"These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:44.135635Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}