CVE:CVE-2007-5894
CNNVD:CNNVD-200712-056
Kerberos是美国麻省理工学院（MIT）开发的一套网络认证协议，它采用客户端/服务器结构，并且客户端和服务器端均可对对方进行身份认证（即双重验证），可防止窃听、防止replay攻击等。MIT Kerberos 5（又名krb5）是美国麻省理工学院（MIT）开发的一套网络认证协议，它采用客户端/服务器结构，并且客户端和服务器端均可对对方进行身份认证（即双重验证），可防止窃听、防止replay攻击等。
Kerberos的实现上存在多个内存破坏漏洞，远程攻击者可能利用这些漏洞导致服务程序崩溃。
gssftp的ftpd是Kerberos加密的FTP服务器，可通过Kerberos 5认证。在ftpd.c的reply()函数中存在未初始化的指针：
 void reply(int n, char *fmt, ...)
        {
...
(1)  int length, kerror; <---- declared length  without initializer
                        if (n) sprintf(in, "%d%c", n, cont_char);
                        else in[0] = '';
                        strncat(in, buf, sizeof (in) - strlen(in) - 1);
        #ifdef KRB5_KRB4_COMPAT
                        if (strcmp(auth_type, "KERBEROS_V4") == 0) {
                                if (clevel == PROT_P)
                                        length = krb_mk_priv((unsigned char
*)in,
                                                             (unsigned char
*)out,
                                                             strlen(in),
                                                             schedule,
&kdata.session,
                                                             &ctrl_addr,
                                                             &his_addr);
                                else
                                        length = krb_mk_safe((unsigned char
*)in,
                                                             (unsigned char
*)out,
                                                             strlen(in),
                                                             &kdata.session,
                                                             &ctrl_addr,
                                                             &his_addr);
                                if (length == -1) {
                                        syslog(LOG_ERR,
                                               "krb_mk_%s failed for
KERBEROS_V4",
                                               clevel == PROT_P ? "priv" :
"safe");
                                        fputs(in,stdout);
                                }
                        } else
        #endif /* KRB5_KRB4_COMPAT */
        #ifdef GSSAPI
                        /* reply (based on level) */
                        if (strcmp(auth_type, "GSSAPI") == 0) {
                                gss_buffer_desc in_buf, out_buf;
                                OM_uint32 maj_stat, min_stat;
                                int conf_state;
                                in_buf.value = in;
                                in_buf.length = strlen(in);
                                maj_stat = gss_seal(&min_stat, gcontext,
                                                    clevel == PROT_P, /*
private */
                                                    GSS_C_QOP_DEFAULT,
                                                    &in_buf, &conf_state,
                                                    &out_buf);
                                if (maj_stat != GSS_S_COMPLETE) {
        #if 0
        /* Don't setup an infinite loop */
                                        /* generally need to deal */
                                        secure_gss_error(maj_stat, min_stat,
                                                       (clevel==PROT_P)?
                                                         "gss_seal ENC didn't
complete":
                                                         "gss_seal MIC didn't
complete");
        #endif /* 0 */
                                } else if ((clevel == PROT_P) && !conf_state) {
        #if 0
        /* Don't setup an infinite loop */
                                        secure_error("GSSAPI didn't encrypt
message");
        #endif /* 0 */
                                } else {
                                        memcpy(out, out_buf.value, 
                                               length=out_buf.length);
                                        gss_release_buffer(&min_stat,
&out_buf);
                                }
                        }
        #endif /* GSSAPI */
                        /* Othe
solution:Upgrade mit kerberos_5 to a higher version than -