CVE-2004-1189

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Dec 31, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2004

CVE-2004-11902.1SUSE Linux before 9.1 and SUSE Linux Enterprise Server before 9 do not properly check commands sent to CD devices that have been opened read CVE-2004-11911.2Race condition in SuSE Linux 8.1 through 9.2, when run on SMP systems that have more than 4GB of memory, could allow local users to read una CVE-2004-119210.0Format string vulnerability in the lprintf function in Citadel/UX 6.27 and earlier allows remote attackers to execute arbitrary code via for CVE-2004-11936.6Prevx Home 1.0 allows local users with administrator privileges to bypass the intrusion prevention features by directly writing to \device\p CVE-2004-11945.0Buffer overflow in Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a lon CVE-2004-11955.0Star Wars Battlefront 1.11 and earlier allows remote attackers to cause a denial of service (application crash) via a join request that cont CVE-2004-11966.8Cross-site scripting (XSS) vulnerability in inmail.pl in Insite Inmail allows remote attackers to inject arbitrary web script or HTML via th CVE-2004-11976.8Cross-site scripting (XSS) vulnerability in inshop.pl in Insite inShop allows remote attackers to inject arbitrary web script or HTML via th CVE-2004-11985.0Microsoft Internet Explorer allows remote attackers to cause a denial of service (application crash from memory consumption), as demonstrate CVE-2004-11995.0Safari 1.2.4 on Mac OS X 10.3.6 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstr CVE-2004-12005.0Firefox and Mozilla allow remote attackers to cause a denial of service (application crash from memory consumption), as demonstrated using J CVE-2004-12015.0Opera 7.54 allows remote attackers to cause a denial of service (application crash from memory exhaustion), as demonstrated using Javascript