{"schemaVersion":3,"id":"CVE-2008-0947","aliases":["DEBIAN-CVE-2008-0947"],"status":"published","duplicateOf":null,"title":null,"description":"Buffer overflow in the RPC library used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.4 through 1.6.3 allows remote attackers to execute arbitrary code by triggering a large number of open file descriptors.","dates":{"published":"2008-03-19T00:00:00.000Z","modified":"2024-08-07T08:01:40.133Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.08832,"percentile":0.95154,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.08832},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08832,"percentile":0.95154}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.08832,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.08832,"percentile":0.95154}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"debian","product":"krb5","name":"krb5","label":"krb5","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/krb5","purlType":"deb","versions":[{"text":"< 1.6.dfsg.3~beta1-4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.dfsg.3~beta1-4","eol":null,"hubHref":null},{"vendor":"mit","product":"kerberos_5","name":"kerberos 5","label":"kerberos_5","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.4","noFixRecorded":false,"fixedIn":null},{"text":"1.4.1","noFixRecorded":false,"fixedIn":null},{"text":"1.4.2","noFixRecorded":false,"fixedIn":null},{"text":"1.4.3","noFixRecorded":false,"fixedIn":null},{"text":"1.4.4","noFixRecorded":false,"fixedIn":null},{"text":"1.5","noFixRecorded":false,"fixedIn":null},{"text":"1.5.1","noFixRecorded":false,"fixedIn":null},{"text":"1.5.2","noFixRecorded":false,"fixedIn":null},{"text":"1.5.3","noFixRecorded":false,"fixedIn":null},{"text":"1.6","noFixRecorded":false,"fixedIn":null},{"text":"1.6.1","noFixRecorded":false,"fixedIn":null},{"text":"1.6.2","noFixRecorded":false,"fixedIn":null},{"text":"1.6.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.4 | 1.4.1 | 1.4.2 | 1.4.3 | 1.4.4 | 1.5 | 1.5.1 | 1.5.2 | 1.5.3 | 1.6 | 1.6.1 | 1.6.2 | 1.6.3","eol":null,"hubHref":"/vendor/mit/kerberos_5"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://securityreason.com/securityalert/3752","label":"securityreason.com/securityalert/3752","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-079B.html","label":"www.us-cert.gov/cas/techalerts/TA08-079B.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://secunia.com/advisories/29457","label":"secunia.com/advisories/29457","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:069","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:069","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://www.securityfocus.com/archive/1/489784/100/0/threaded","label":"www.securityfocus.com/archive/1/489784/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://secunia.com/advisories/29464","label":"secunia.com/advisories/29464","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/bid/28302","label":"www.securityfocus.com/bid/28302","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00537.html","label":"www.redhat.com/archives/fedora-package-announce/2008-March/msg00537.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2008-0112","label":"wiki.rpath.com/Advisories:rPSA-2008-0112","hostname":"wiki.rpath.com","tags":["X Refsource CONFIRM"]},{"url":"http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022542.html","label":"support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022542.html","hostname":"support.novell.com","tags":["X Refsource CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=130497213107107&w=2","label":"marc.info?l=bugtraq&m=130497213107107&w=2","hostname":"marc.info","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://secunia.com/advisories/29451","label":"secunia.com/advisories/29451","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/29663","label":"secunia.com/advisories/29663","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2008-March/msg00544.html","label":"www.redhat.com/archives/fedora-package-announce/2008-March/msg00544.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0112","label":"wiki.rpath.com/wiki/Advisories:rPSA-2008-0112","hostname":"wiki.rpath.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/29438","label":"secunia.com/advisories/29438","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0164.html","label":"www.redhat.com/support/errata/RHSA-2008-0164.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2008:070","label":"www.mandriva.com/security/advisories?name=MDVSA-2008:070","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://www.vupen.com/english/advisories/2008/0922/references","label":"www.vupen.com/english/advisories/2008/0922/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/29435","label":"secunia.com/advisories/29435","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10984","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10984","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.securityfocus.com/archive/1/489883/100/0/threaded","label":"www.securityfocus.com/archive/1/489883/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://secunia.com/advisories/29428","label":"secunia.com/advisories/29428","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.debian.org/security/2008/dsa-1524","label":"www.debian.org/security/2008/dsa-1524","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN"]},{"url":"http://www.securityfocus.com/archive/1/489762/100/0/threaded","label":"www.securityfocus.com/archive/1/489762/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022520.html","label":"support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022520.html","hostname":"support.novell.com","tags":["X Refsource CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html","label":"lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://secunia.com/advisories/29516","label":"secunia.com/advisories/29516","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-002.txt","label":"web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-002.txt","hostname":"web.mit.edu","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/29462","label":"secunia.com/advisories/29462","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://secunia.com/advisories/29424","label":"secunia.com/advisories/29424","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securitytracker.com/id?1019631","label":"www.securitytracker.com/id?1019631","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://www.ubuntu.com/usn/usn-587-1","label":"www.ubuntu.com/usn/usn-587-1","hostname":"www.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://www.vupen.com/english/advisories/2008/1102/references","label":"www.vupen.com/english/advisories/2008/1102/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://security.gentoo.org/glsa/glsa-200803-31.xml","label":"security.gentoo.org/glsa/glsa-200803-31.xml","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO"]},{"url":"http://www.kb.cert.org/vuls/id/374121","label":"www.kb.cert.org/vuls/id/374121","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41273","label":"exchange.xforce.ibmcloud.com/vulnerabilities/41273","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-0947","label":"security-tracker.debian.org/tracker/CVE-2008-0947","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-1524-1","OPENSUSE-SU-2024:10899-1","RHSA-2008:0164"],"duplicates":[],"related":["OPENSUSE-SU-2024:10899-1"]},"timeline":[{"kind":"published","date":"2008-03-19T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T08:01:40.133Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T15:05:42.916Z","stale":false,"partial":false}}