CVE-2007-4000 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2007-4000 Interim 1 17 2025-11-05T06:19:47Z current 2021-05-30T12:39:43Z 2025-11-05T06:19:47Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2007-4000 The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/UBLPLGSRDQQXOBBXTFGPXQZUFQYCTZ7C/#UBLPLGSRDQQXOBBXTFGPXQZUFQYCTZ7C E-Mail link for SUSE-SR:2007:019 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Server 11 SP1 SUSE Linux Enterprise Server 11 SP2 SUSE Linux Enterprise Server 11 SP3 SUSE Linux Enterprise Server 11 SP4 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Enterprise Server 16.0 SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 openSUSE Tumbleweed krb5-1.19.2-2.2 krb5-1.20.1-4.11 krb5-1.21.3-160000.2.2 krb5-1.21.3-slfo.1.1_1.2 krb5-1.6.3-133.27.1 krb5-1.6.3-133.48.48.1 krb5-1.6.3-133.49.54.1 krb5-1.6.3-133.49.66.1 krb5-32bit-1.19.2-2.2 krb5-32bit-1.6.3-133.27.1 krb5-32bit-1.6.3-133.48.48.1 krb5-32bit-1.6.3-133.49.54.1 krb5-32bit-1.6.3-133.49.66.1 krb5-apps-clients-1.6.3-133.27.1 krb5-apps-clients-1.6.3-133.48.48.1 krb5-apps-clients-1.6.3-133.49.54.1 krb5-apps-clients-1.6.3-133.49.66.1 krb5-apps-servers-1.6.3-133.27.1 krb5-apps-servers-1.6.3-133.48.48.1 krb5-apps-servers-1.6.3-133.49.54.1 krb5-apps-servers-1.6.3-133.49.66.1 krb5-client-1.19.2-2.2 krb5-client-1.21.3-160000.2.2 krb5-client-1.6.3-133.27.1 krb5-client-1.6.3-133.48.48.1 krb5-client-1.6.3-133.49.54.1 krb5-client-1.6.3-133.49.66.1 krb5-devel-1.19.2-2.2 krb5-devel-1.21.3-160000.2.2 krb5-devel-1.6.3-133.49.66.1 krb5-devel-32bit-1.19.2-2.2 krb5-devel-32bit-1.6.3-133.49.66.1 krb5-doc-1.6.3-133.21 krb5-doc-1.6.3-133.49.54.1 krb5-doc-1.6.3-133.49.66.1 krb5-plugin-kdb-ldap-1.19.2-2.2 krb5-plugin-kdb-ldap-1.21.3-160000.2.2 krb5-plugin-kdb-ldap-1.6.3-133.12 krb5-plugin-kdb-ldap-1.6.3-133.49.54.1 krb5-plugin-kdb-ldap-1.6.3-133.49.66.1 krb5-plugin-preauth-otp-1.19.2-2.2 krb5-plugin-preauth-otp-1.21.3-160000.2.2 krb5-plugin-preauth-pkinit-1.19.2-2.2 krb5-plugin-preauth-pkinit-1.21.3-160000.2.2 krb5-plugin-preauth-pkinit-1.6.3-133.12 krb5-plugin-preauth-pkinit-1.6.3-133.49.54.1 krb5-plugin-preauth-pkinit-1.6.3-133.49.66.1 krb5-plugin-preauth-spake-1.19.2-2.2 krb5-plugin-preauth-spake-1.21.3-160000.2.2 krb5-server-1.19.2-2.2 krb5-server-1.21.3-160000.2.2 krb5-server-1.6.3-133.27.1 krb5-server-1.6.3-133.48.48.1 krb5-server-1.6.3-133.49.54.1 krb5-server-1.6.3-133.49.66.1 krb5-x86-1.6.3-133.27.1 krb5-x86-1.6.3-133.48.48.1 krb5-x86-1.6.3-133.49.54.1 krb5-x86-1.6.3-133.49.66.1 krb5-1.6.3-133.27.1 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-32bit-1.6.3-133.27.1 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-apps-clients-1.6.3-133.27.1 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-apps-servers-1.6.3-133.27.1 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-client-1.6.3-133.27.1 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-doc-1.6.3-133.21 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-plugin-kdb-ldap-1.6.3-133.12 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-plugin-preauth-pkinit-1.6.3-133.12 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-server-1.6.3-133.27.1 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-x86-1.6.3-133.27.1 as a component of SUSE Linux Enterprise Server 11 SP1 krb5-1.6.3-133.48.48.1 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-32bit-1.6.3-133.48.48.1 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-apps-clients-1.6.3-133.48.48.1 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-apps-servers-1.6.3-133.48.48.1 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-client-1.6.3-133.48.48.1 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-doc-1.6.3-133.21 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-plugin-kdb-ldap-1.6.3-133.12 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-plugin-preauth-pkinit-1.6.3-133.12 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-server-1.6.3-133.48.48.1 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-x86-1.6.3-133.48.48.1 as a component of SUSE Linux Enterprise Server 11 SP2 krb5-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-32bit-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-apps-clients-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-apps-servers-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-client-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-doc-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-plugin-kdb-ldap-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-plugin-preauth-pkinit-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-server-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-x86-1.6.3-133.49.54.1 as a component of SUSE Linux Enterprise Server 11 SP3 krb5-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-32bit-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-apps-clients-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-apps-servers-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-client-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-doc-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-plugin-kdb-ldap-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-plugin-preauth-pkinit-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-server-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-x86-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Server 11 SP4 krb5-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-client-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-devel-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-plugin-kdb-ldap-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-plugin-preauth-otp-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-plugin-preauth-pkinit-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-plugin-preauth-spake-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-server-1.21.3-160000.2.2 as a component of SUSE Linux Enterprise Server 16.0 krb5-devel-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 krb5-devel-32bit-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 krb5-server-1.6.3-133.49.66.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 krb5-1.20.1-4.11 as a component of SUSE Linux Micro 6.0 krb5-1.21.3-slfo.1.1_1.2 as a component of SUSE Linux Micro 6.1 krb5-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-32bit-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-client-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-devel-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-devel-32bit-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-kdb-ldap-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-preauth-otp-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-preauth-pkinit-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-plugin-preauth-spake-1.19.2-2.2 as a component of openSUSE Tumbleweed krb5-server-1.19.2-2.2 as a component of openSUSE Tumbleweed The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer. CVE-2007-4000 SUSE Linux Enterprise Server 11 SP1:krb5-1.6.3-133.27.1 SUSE Linux Enterprise Server 11 SP1:krb5-32bit-1.6.3-133.27.1 SUSE Linux Enterprise Server 11 SP1:krb5-apps-clients-1.6.3-133.27.1 SUSE Linux Enterprise Server 11 SP1:krb5-apps-servers-1.6.3-133.27.1 SUSE Linux Enterprise Server 11 SP1:krb5-client-1.6.3-133.27.1 SUSE Linux Enterprise Server 11 SP1:krb5-doc-1.6.3-133.21 SUSE Linux Enterprise Server 11 SP1:krb5-plugin-kdb-ldap-1.6.3-133.12 SUSE Linux Enterprise Server 11 SP1:krb5-plugin-preauth-pkinit-1.6.3-133.12 SUSE Linux Enterprise Server 11 SP1:krb5-server-1.6.3-133.27.1 SUSE Linux Enterprise Server 11 SP1:krb5-x86-1.6.3-133.27.1 SUSE Linux Enterprise Server 11 SP2:krb5-1.6.3-133.48.48.1 SUSE Linux Enterprise Server 11 SP2:krb5-32bit-1.6.3-133.48.48.1 SUSE Linux Enterprise Server 11 SP2:krb5-apps-clients-1.6.3-133.48.48.1 SUSE Linux Enterprise Server 11 SP2:krb5-apps-servers-1.6.3-133.48.48.1 SUSE Linux Enterprise Server 11 SP2:krb5-client-1.6.3-133.48.48.1 SUSE Linux Enterprise Server 11 SP2:krb5-doc-1.6.3-133.21 SUSE Linux Enterprise Server 11 SP2:krb5-plugin-kdb-ldap-1.6.3-133.12 SUSE Linux Enterprise Server 11 SP2:krb5-plugin-preauth-pkinit-1.6.3-133.12 SUSE Linux Enterprise Server 11 SP2:krb5-server-1.6.3-133.48.48.1 SUSE Linux Enterprise Server 11 SP2:krb5-x86-1.6.3-133.48.48.1 SUSE Linux Enterprise Server 11 SP3:krb5-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-32bit-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-apps-clients-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-apps-servers-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-client-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-doc-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-plugin-kdb-ldap-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-plugin-preauth-pkinit-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-server-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP3:krb5-x86-1.6.3-133.49.54.1 SUSE Linux Enterprise Server 11 SP4:krb5-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-32bit-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-apps-clients-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-apps-servers-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-client-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-doc-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-plugin-kdb-ldap-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-plugin-preauth-pkinit-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-server-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 11 SP4:krb5-x86-1.6.3-133.49.66.1 SUSE Linux Enterprise Server 16.0:krb5-1.21.3-160000.2.2 SUSE Linux Enterprise Server 16.0:krb5-client-1.21.3-160000.2.2 SUSE Linux Enterprise Server 16.0:krb5-devel-1.21.3-160000.2.2 SUSE Linux Enterprise Server 16.0:krb5-plugin-kdb-ldap-1.21.3-160000.2.2 SUSE Linux Enterprise Server 16.0:krb5-plugin-preauth-otp-1.21.3-160000.2.2 SUSE Linux Enterprise Server 16.0:krb5-plugin-preauth-pkinit-1.21.3-160000.2.2 SUSE Linux Enterprise Server 16.0:krb5-plugin-preauth-spake-1.21.3-160000.2.2 SUSE Linux Enterprise Server 16.0:krb5-server-1.21.3-160000.2.2 SUSE Linux Enterprise Software Development Kit 11 SP4:krb5-devel-1.6.3-133.49.66.1 SUSE Linux Enterprise Software Development Kit 11 SP4:krb5-devel-32bit-1.6.3-133.49.66.1 SUSE Linux Enterprise Software Development Kit 11 SP4:krb5-server-1.6.3-133.49.66.1 SUSE Linux Micro 6.0:krb5-1.20.1-4.11 SUSE Linux Micro 6.1:krb5-1.21.3-slfo.1.1_1.2 openSUSE Tumbleweed:krb5-1.19.2-2.2 openSUSE Tumbleweed:krb5-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-client-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-1.19.2-2.2 openSUSE Tumbleweed:krb5-devel-32bit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-kdb-ldap-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-otp-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-pkinit-1.19.2-2.2 openSUSE Tumbleweed:krb5-plugin-preauth-spake-1.19.2-2.2 openSUSE Tumbleweed:krb5-server-1.19.2-2.2 important 8.5 AV:N/AC:M/Au:S/C:C/I:C/A:C