CVE-2006-6143

2007-01-1000:00:00

CWE-824

mitre

web.nvd.nist.gov

rpc

kerberos 5

remote code execution

security vulnerability

nvd

cve-2006-6143

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.609

Percentile

97.8%

JSON

The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

Affected configurations

Nvd

Node

mitkerberos_5Match1.4

mitkerberos_5Match1.4.1

mitkerberos_5Match1.4.2

mitkerberos_5Match1.4.3

mitkerberos_5Match1.4.4

mitkerberos_5Match1.5

mitkerberos_5Match1.5.1

Node

canonicalubuntu_linuxMatch6.06

canonicalubuntu_linuxMatch6.10

VendorProductVersionCPE
mitkerberos_51.5.1cpe:/a:mit:kerberos_5:1.5.1:::
mitkerberos_51.4cpe:/a:mit:kerberos_5:1.4:::
mitkerberos_51.4.3cpe:/a:mit:kerberos_5:1.4.3:::
mitkerberos_51.4.1cpe:/a:mit:kerberos_5:1.4.1:::
mitkerberos_51.5cpe:/a:mit:kerberos_5:1.5:::
mitkerberos_51.4.4cpe:/a:mit:kerberos_5:1.4.4:::
mitkerberos_51.4.2cpe:/a:mit:kerberos_5:1.4.2:::

Vendor	Product	Version	CPE
mit	kerberos_5	1.5.1	cpe:/a:mit:kerberos_5:1.5.1:::
mit	kerberos_5	1.4	cpe:/a:mit:kerberos_5:1.4:::
mit	kerberos_5	1.4.3	cpe:/a:mit:kerberos_5:1.4.3:::
mit	kerberos_5	1.4.1	cpe:/a:mit:kerberos_5:1.4.1:::
mit	kerberos_5	1.5	cpe:/a:mit:kerberos_5:1.5:::
mit	kerberos_5	1.4.4	cpe:/a:mit:kerberos_5:1.4.4:::
mit	kerberos_5	1.4.2	cpe:/a:mit:kerberos_5:1.4.2:::