Description
Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.4.4-8 | — |
| Debian 13 | krb5 | 1.4.4-8 | — |
| Debian 12 | krb5 | 1.4.4-8 | — |
| Debian 4.0 | krb5 | 1.4.4-7etch1 | DSA-1276-1 |
| Debian 3.1 | krb5 | 1.3.6-2sarge4 | DSA-1276-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | krb5 +4 | 1.5-23 | RHSA-2007:0095 |
| RHEL 4 | krb5 +4 | 1.3.4-46 | RHSA-2007:0095 |
| RHEL 3 | krb5 +4 | 1.2.7-61 | RHSA-2007:0095 |
| RHEL 2 | krb5 +4 | 1.2.2-44 | RHSA-2007:0095 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | krb5 | 1.19.2-2.2 | openSUSE-SU-2024:10899-1 |
Advisories 3
- RHSA-2007:0095 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1276-1 krb5 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10899-1 krb5-1.19.2-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- oval:org.mitre.oval:def:10757 vdb-entry signature
- ADV-2007-1218 vdb-entry
- http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-002-syslog.txt
- 20070403 MITKRB5-SA-2007-002: KDC, kadmind stack overflow in krb5_klog_syslog [CVE-2007-0957] mailing-list
- 24966 third-party-advisory
- 24706 third-party-advisory
- 24798 third-party-advisory
- 24740 third-party-advisory
- RHSA-2007:0095 vendor-advisory
- ADV-2007-1983 vdb-entry
- 24786 third-party-advisory
- 102930 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=305391
- TA07-093B third-party-advisory
- 20070405 FLEA-2007-0008-1: krb5 mailing-list
- DSA-1276 vendor-advisory
- 24735 third-party-advisory
- 23285 vdb-entry
- TA07-109A third-party-advisory
- 24750 third-party-advisory
- ADV-2007-1250 vdb-entry
- 24817 third-party-advisory
- 24757 third-party-advisory
- kerberos-krb5klogsyslog-bo(33411) vdb-entry
- VU#704024 third-party-advisory
- 1017849 vdb-entry
- SUSE-SA:2007:025 vendor-advisory
- 24785 third-party-advisory
- 25464 third-party-advisory
- MDKSA-2007:077 vendor-advisory
- USN-449-1 vendor-advisory
- APPLE-SA-2007-04-19 vendor-advisory
- ADV-2007-1470 vdb-entry
- 24736 third-party-advisory
- 20070404 rPSA-2007-0063-1 krb5 krb5-server krb5-services krb5-test krb5-workstation mailing-list
- GLSA-200704-02 vendor-advisory