Security Vulnerability: kadmind stack buffer overflow vulnerability

  • 3675615
  • 10-Jul-2007
  • 27-Apr-2012


Novell KDC 1.0.2 and prior


An authenticated remote user may be able to cause a host running kadmind to execute arbitrary code.

Successful exploitation can compromise the Kerberos key database and host security on the KDC host.  (kadmind typically runs as root.)
Unsuccessful exploitation attempts will likely result in kadmind crashing.


Fix is in Novell KDC version 1.0.3 or newer available at


Security Alert

Additional Information

MITKRB5-SA-2007-005: kadmind vulnerable to buffer overflow

CVE: CVE-2007-2798
CERT: VU#554257

This vulnerability was reported to MIT by iDefense.  iDefense credits an anonymous discoverer.