{"identifier":"CVE-2007-5894","cve":{"id":"CVE-2007-5894","description":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","published":"2007-12-06T02:46:00+00:00","modified":"2026-11-06T17:19:45.163000+00:00","status":"Analyzed","score":9.3,"severity":"CRITICAL","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","cvss_version":"2.0","affected":[{"criteria":"cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"1.6.4"}],"weaknesses":["NVD-CWE-noinfo"],"references":[{"url":"http://bugs.gentoo.org/show_bug.cgi?id=199205","source":"cve@mitre.org","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"http://osvdb.org/44333","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://seclists.org/fulldisclosure/2007/Dec/0176.html","source":"cve@mitre.org","tags":["Mailing List"]},{"url":"http://seclists.org/fulldisclosure/2007/Dec/0321.html","source":"cve@mitre.org","tags":["Mailing List"]},{"url":"http://secunia.com/advisories/28636","source":"cve@mitre.org","tags":["Vendor Advisory","Broken Link"]},{"url":"http://secunia.com/advisories/29457","source":"cve@mitre.org","tags":["Vendor Advisory","Broken Link"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2008-0112","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0112","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://www.novell.com/linux/security/advisories/suse_security_summary_report.html","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/489883/100/0/threaded","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/26750","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"https://issues.rpath.com/browse/RPL-2012","source":"cve@mitre.org","tags":["Broken Link"]},{"url":"http://bugs.gentoo.org/show_bug.cgi?id=199205","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Mailing List","Third Party Advisory"]},{"url":"http://osvdb.org/44333","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://seclists.org/fulldisclosure/2007/Dec/0176.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"http://seclists.org/fulldisclosure/2007/Dec/0321.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List"]},{"url":"http://secunia.com/advisories/28636","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory","Broken Link"]},{"url":"http://secunia.com/advisories/29457","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory","Broken Link"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2008-0112","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0112","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://www.novell.com/linux/security/advisories/suse_security_summary_report.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/489883/100/0/threaded","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"http://www.securityfocus.com/bid/26750","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]},{"url":"https://issues.rpath.com/browse/RPL-2012","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"]}],"kev":null,"kev_checked":true,"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10.0,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*","versionEndExcluding":"1.6.4","matchCriteriaId":"46577766-3490-43FD-8DDB-DDEF8862420D"}]}]}],"source":"nvd","retrieved_at":"2026-11-06T19:24:30.378707+00:00","exploited":false,"kev_stale":false,"products":["mit / kerberos 5"],"priority":{"label":"Critical technical severity","reasons":["CVSS is at least 9.0; exploitation is not established by severity alone."]},"epss":{"probability":0.03276,"percentile":0.88497,"date":"2026-11-07","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"bugs.gentoo.org","source_url":"http://bugs.gentoo.org/show_bug.cgi?id=199205","investigate_url":"https://investigate.aeglixmind.com/#bugs.gentoo.org"},{"domain":"osvdb.org","source_url":"http://osvdb.org/44333","investigate_url":"https://investigate.aeglixmind.com/#osvdb.org"},{"domain":"seclists.org","source_url":"http://seclists.org/fulldisclosure/2007/Dec/0176.html","investigate_url":"https://investigate.aeglixmind.com/#seclists.org"},{"domain":"secunia.com","source_url":"http://secunia.com/advisories/28636","investigate_url":"https://investigate.aeglixmind.com/#secunia.com"},{"domain":"wiki.rpath.com","source_url":"http://wiki.rpath.com/Advisories:rPSA-2008-0112","investigate_url":"https://investigate.aeglixmind.com/#wiki.rpath.com"},{"domain":"www.novell.com","source_url":"http://www.novell.com/linux/security/advisories/suse_security_summary_report.html","investigate_url":"https://investigate.aeglixmind.com/#www.novell.com"},{"domain":"www.securityfocus.com","source_url":"http://www.securityfocus.com/archive/1/489883/100/0/threaded","investigate_url":"https://investigate.aeglixmind.com/#www.securityfocus.com"},{"domain":"issues.rpath.com","source_url":"https://issues.rpath.com/browse/RPL-2012","investigate_url":"https://investigate.aeglixmind.com/#issues.rpath.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2007-5894","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2007-5894","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2007-5894","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}