CVE-2004-0523

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 11.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-08-18 · updated 2026-06-16

Description

Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.

Affected products

MIT Kerberos: 1.0, 1.0.8, 1.2.2.beta1
MIT Kerberos 5: 1.0, 1.0.6, 1.1, 1.1.1, 1.2, 1.2-beta1 (+11)
Sgi Propack: 2.4, 3.0
Sun Seam: 1.0, 1.0.1, 1.0.2
Sun Solaris: 8.0, 9.0
Sunos: 5.8
Tinysofa Enterprise Server: 1.0, 1.0_u1

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000860
http://lwn.net/Articles/88206/
http://marc.info/?l=bugtraq&m=108612325909496&w=2
http://marc.info/?l=bugtraq&m=108619161815320&w=2
http://marc.info/?l=bugtraq&m=108619250923790&w=2
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101512-1
http://www.debian.org/security/2004/dsa-520
http://www.gentoo.org/security/en/glsa/glsa-200406-21.xml
http://www.kb.cert.org/vuls/id/686862
http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:056

Get alerted when CVE-2004-0523 or the next vulnerability affects your stack