What’s Vulnerable › Vulnerabilities

CVE-2008-0063

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2008-03-19 · updated 2026-06-16
• Weakness: CWE-908

Description

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "Uninitialized stack values."

Affected products

• macOS: before 10.4.11; from 10.5.0 before 10.5.2 — fixed in 10.4.11, 10.5.2
• Apple Mac Os X Server: before 10.4.11; from 10.5.0 before 10.5.2 — fixed in 10.4.11, 10.5.2
• Canonical Ubuntu Linux: 6.06, 6.10, 7.04, 7.10
• Debian Linux: 3.1, 4.0
• Fedoraproject Fedora: 7, 8
• MIT Kerberos 5: through 1.6.3
• Opensuse: 10.2, 10.3
• SUSE Linux: 10.1
• SUSE Linux Enterprise Server 15 SP1: 10-sp1
• SUSE Linux Enterprise Server: 10-sp1
• SUSE Linux Enterprise Software Development Kit: 10-sp1

How to fix

Upgrade to a fixed version: macOS 10.4.11, 10.5.2; Apple Mac Os X Server 10.4.11, 10.5.2. Check the vendor advisory for mitigations.

References

• http://docs.info.apple.com/article.html?artnum=307562
• http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html
• http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html
• http://secunia.com/advisories/29420
• http://secunia.com/advisories/29423
• http://secunia.com/advisories/29424
• http://secunia.com/advisories/29428
• http://secunia.com/advisories/29435
• http://secunia.com/advisories/29438
• http://secunia.com/advisories/29450
• http://secunia.com/advisories/29451
• http://secunia.com/advisories/29457

Get alerted when CVE-2008-0063 or the next vulnerability affects your stack