CVE-2007-1216 describes a double free vulnerability in the GSS-API library within MIT krb5 before version 1.6.1, specifically impacting the Kerberos administration daemon (kadmind) when using the RPCSEC_GSS RPC library. This flaw allows remote authenticated attackers to execute arbitrary code and modify the Kerberos key database through a specially crafted message. The vulnerability carries a critical CVSS score of 9.0, indicating a severe risk. Its attack vector is network-based with low attack complexity, and successful exploitation grants complete confidentiality, integrity, and availability impact. Despite its high severity, there is no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are also minimal, suggesting a lack of widespread attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.6.1CPE matchmatch criteria | cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:* | ||
5.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:5.10:*:*:*:*:*:*:* | ||
6.06CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:* | ||
6.10CPE matchmatch criteria | cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:* | ||
3.1CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:3.1:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:S/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.