CVE-2007-3999
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the...
CVE-2007-3999 is a high vulnerability (CVSS 10.0) in Mit Kerberos 5, published September 4, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.0%, the 95th percentile. Fixed in krb5 1.6.dfsg.1-7.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 11.0%EPSS, 95th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.6.dfsg.1-7krb5 +39 more
Description
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 | before 1.6.dfsg.1-7 | 1.6.dfsg.1-7 |
krb5Debian:13 | before 1.6.dfsg.1-7 | 1.6.dfsg.1-7 |
krb5Debian:14 | before 1.6.dfsg.1-7 | 1.6.dfsg.1-7 |
krb5Debian:4.0 From an advisory covering 2 CVEs | before 1.4.4-7etch4, plus listed versions 1.4.4-7etch11.4.4-7etch21.4.4-7etch3 | 1.4.4-7etch4 |
librpcsecgssDebian:4.0 | before 0.14-2etch1, plus listed versions 0.14-2 | 0.14-2etch1 |
krb5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-serverRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5Red Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
krb5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-libsRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-workstationRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5Red Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-libsRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-serverRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
krb5-workstationRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.5-29 | 0:1.5-29 |
nfs-utils-libRed Hat:enterprise_linux:4::as | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:4::as | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-develRed Hat:enterprise_linux:4::as | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-libRed Hat:enterprise_linux:4::desktop | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:4::desktop | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-develRed Hat:enterprise_linux:4::desktop | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-libRed Hat:enterprise_linux:4::es | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:4::es | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-develRed Hat:enterprise_linux:4::es | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-libRed Hat:enterprise_linux:4::ws | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:4::ws | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-lib-develRed Hat:enterprise_linux:4::ws | before 0:1.0.6-8.z1 | 0:1.0.6-8.z1 |
nfs-utils-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-libRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-libRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs | before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
krb5openSUSE:Tumbleweed From an advisory covering 20 CVEs | before 1.19.2-2.2 | 1.19.2-2.2 |
What each source reports
NVD Score used
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
- Record
CVE-2007-3999- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
- Record
CVE-2007-3999- Updated
- 2026-11-02
EUVDEUVD-2007-3983No score
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
- Record
EUVD-2007-3983- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-62qg-wq9p-p6p2No score
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the...
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
- Record
GHSA-62qg-wq9p-p6p2- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVNo score
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
- Record
CVE-2007-3999- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-3999No score
Stack-based buffer overflow in the svcauth_gss_validate function in lib/rpc/svc_auth_gss.c in the RPCSEC_GSS RPC library (librpcsecgss) in MIT Kerberos 5 (krb5) 1.4 through 1.6.2, as used by the Kerberos administration daemon (kadmind) and some third-party applications that use krb5, allows remote attackers to cause a denial of service (daemon crash) and probably execute arbitrary code via a long string in an RPC message.
- Record
DEBIAN-CVE-2007-3999- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10899-1No score
krb5-1.19.2-2.2 on GA media
These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10899-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11002-1No score
libtirpc-devel-1.3.2-2.1 on GA media
These are all security issues fixed in the libtirpc-devel-1.3.2-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11002-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| affected, aliases, facts, published, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
gentoo.org/security/en/glsa/glsa-200709-01.xml
redhat.com/archives/fedora-package-announce/2007-September/msg00087.html
securityfocus.com/archive/1/479251/100/0/threaded
secunia.com/advisories/26713
Show 97 moreShow less
vupen.com/english/advisories/2008/0803/references
novell.com/linux/security/advisories/2007_19_sr.html
securitytracker.com/id?1018647
debian.org/security/2007/dsa-1367
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A3162
bugzilla.redhat.com/show_bug.cgi?id=250973
trustix.org/errata/2007/0026
lists.apple.com/archives/security-announce/2007/Nov/msg00002.html
docs.info.apple.com/article.html?artnum=307041
ubuntu.com/usn/usn-511-1
sunsolve.sun.com/search/document.do?assetkey=1-66-201319-1
security.gentoo.org/glsa/glsa-200710-01.xml
lists.rpath.com/pipermail/security-announce/2007-September/000237.html
mandriva.com/security/advisories?name=MDKSA-2007:181
zerodayinitiative.com/advisories/ZDI-07-052.html
web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt
kb.cert.org/vuls/id/883632
exchange.xforce.ibmcloud.com/vulnerabilities/36437
us-cert.gov/cas/techalerts/TA07-319A.html
securityreason.com/securityalert/3092
support.avaya.com/elmodocs2/security/ASA-2007-396.htm
nvd.nist.gov/vuln/detail/CVE-2007-3999
github.com/advisories/GHSA-62qg-wq9p-p6p2
security-tracker.debian.org/tracker/CVE-2007-3999
access.redhat.com/errata/RHSA-2007:0858
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0858.json
cve.org/CVERecord?id=CVE-2007-3999
suse.com/security/cve/CVE-2006-6143