Quantum Secular Labs / Blog / Advisories

CVE-2007-0956: Mit Kerberos 5: Authentication bypass

CVE-2007-0956 has a CVSS v2 base score of 10.0 (the maximum on that scale) and NVD lists 3 affected products, including Mit Kerberos 5. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

Access vector: Network. Exploitable remotely over the network.
Access complexity: Low. No special conditions are required.
Authentication: None. No authentication is needed.
Confidentiality impact: Complete. Total information disclosure.
Integrity impact: Complete. Total loss of integrity.
Availability impact: Complete. Total shutdown of the component.

Underlying weakness

CWE-306: Missing Authentication for Critical Functionality

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected products

Mit Kerberos 5: before 1.6.1
Debian Linux: 3.1; 4.0
Canonical Ubuntu Linux: 5.10; 6.06; 6.10