CVE-2008-0063

Published: Mar 19, 2008Modified: Apr 23, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

Affected (19)

Products: Mit: Kerberos 5 · Apple: Mac Os X, Mac Os X Server · Opensuse: Opensuse · +4 more

Show all products

Mit: Kerberos 5 · Apple: Mac Os X, Mac Os X Server · Opensuse: Opensuse · Suse: Linux, Linux Enterprise Desktop, Linux Enterprise Server, Linux Enterprise Software Development Kit · Debian: Debian Linux · Canonical: Ubuntu Linux · Fedoraproject: Fedora

1 product

2 products

1 product

4 products

Linux Enterprise Desktop

Linux Enterprise Server

Linux Enterprise Software Development Kit

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	Up to 1.6.3

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Before 10.4.11
Apple Mac Os X	From 10.5.0 to 10.5.2
Apple Mac Os X Server	Before 10.4.11
Apple Mac Os X Server	From 10.5.0 to 10.5.2

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 10.2
Opensuse Opensuse	Version 10.3
Suse Linux	Version 10.1
Suse Linux Enterprise Desktop	Version 10 sp1
Suse Linux Enterprise Server	Version 10 sp1
Suse Linux Enterprise Software Development Kit	Version 10 sp1

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1
Debian Debian Linux	Version 4.0

Configuration E

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 6.10
Canonical Ubuntu Linux	Version 7.04
Canonical Ubuntu Linux	Version 7.10

Configuration F

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 7
Fedoraproject Fedora	Version 8

Related CWEs

CWE-908

Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

References (92)

http://docs.info.apple.com/article.html?artnum=307562

Source: cve@mitre.org

Broken Link

http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html

Source: cve@mitre.org

Mailing List

http://secunia.com/advisories/29420

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29423

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29424

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29428

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29435

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29438

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29450

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29451

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29457

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29462

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29464

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29516

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/29663

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/30535

Source: cve@mitre.org

Broken LinkVendor Advisory

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022520.html

Source: cve@mitre.org

Broken Link

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022542.html

Source: cve@mitre.org

Broken Link

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-001.txt

Source: cve@mitre.org

Third Party Advisory

http://wiki.rpath.com/Advisories:rPSA-2008-0112

Source: cve@mitre.org

Broken Link

http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0112

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2008/dsa-1524

Source: cve@mitre.org

Third Party Advisory

http://www.gentoo.org/security/en/glsa/glsa-200803-31.xml

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:069

Source: cve@mitre.org

PatchThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:070

Source: cve@mitre.org

PatchThird Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2008:071

Source: cve@mitre.org

PatchThird Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0164.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0180.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0181.html

Source: cve@mitre.org

Broken Link

http://www.redhat.com/support/errata/RHSA-2008-0182.html

Source: cve@mitre.org

Broken Link

http://www.securityfocus.com/archive/1/489761

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/489883/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/493080/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/28303

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securitytracker.com/id?1019627

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-587-1

Source: cve@mitre.org

Third Party Advisory

http://www.vmware.com/security/advisories/VMSA-2008-0009.html

Source: cve@mitre.org

Third Party Advisory

http://www.vupen.com/english/advisories/2008/0922/references

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2008/0924/references

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2008/1102/references

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.vupen.com/english/advisories/2008/1744

Source: cve@mitre.org

Broken LinkVendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/41277

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8916

Source: cve@mitre.org

Broken Link

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00537.html

Source: cve@mitre.org

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00544.html

Source: cve@mitre.org

Mailing List

http://docs.info.apple.com/article.html?artnum=307562