Description
The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.6.dfsg.1-7 | — |
| Debian 13 | krb5 | 1.6.dfsg.1-7 | — |
| Debian 12 | krb5 | 1.6.dfsg.1-7 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | krb5 +4 | 1.5-29 | RHSA-2007:0858 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | krb5 | 1.19.2-2.2 | openSUSE-SU-2024:10899-1 |
Advisories 2
- RHSA-2007:0858 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10899-1 krb5-1.19.2-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- GLSA-200709-01 vendor-advisory
- FEDORA-2007-2017 vendor-advisory
- SUSE-SR:2007:019 vendor-advisory
- https://issues.rpath.com/browse/RPL-1696
- 26680 third-party-advisory
- 26783 third-party-advisory
- 1018647 vdb-entry
- ADV-2007-3051 vdb-entry
- 26728 third-party-advisory
- 26700 third-party-advisory
- 25533 vdb-entry
- 20070907 FLEA-2007-0050-1 krb5 krb5-workstation mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=250976
- 26987 third-party-advisory
- 26676 third-party-advisory
- kerberos-modifypolicy-code-execution(36438) vdb-entry
- oval:org.mitre.oval:def:9278 vdb-entry signature
- RHSA-2007:0858 vendor-advisory
- VU#377544 third-party-advisory
- http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt
- 3092 third-party-advisory
- MDKSA-2007:174 vendor-advisory