The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka Uninitialized stack values.
The product uses or accesses a resource that has not been initialized.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Kerberos_5 | Mit | * | 1.6.3 (including) |
| Red Hat Enterprise Linux 2.1 | RedHat | krb5-0:1.2.2-48 | * |
| Red Hat Enterprise Linux 3 | RedHat | krb5-0:1.2.7-68 | * |
| Red Hat Enterprise Linux 4 | RedHat | krb5-0:1.3.4-54.el4_6.1 | * |
| Red Hat Enterprise Linux 4.5 Z Stream | RedHat | krb5-0:1.3.4-49.el4_5.1 | * |
| Red Hat Enterprise Linux 5 | RedHat | krb5-0:1.6.1-17.el5_1.1 | * |
| Krb5 | Ubuntu | dapper | * |
| Krb5 | Ubuntu | devel | * |
| Krb5 | Ubuntu | edgy | * |
| Krb5 | Ubuntu | feisty | * |
| Krb5 | Ubuntu | gutsy | * |
| Krb5 | Ubuntu | upstream | * |