{"id":"DEBIAN-CVE-2007-5894","details":"The reply function in ftpd.c in the gssftp ftpd in MIT Kerberos 5 (krb5) does not initialize the length variable when auth_type has a certain value, which has unknown impact and remote authenticated attack vectors.  NOTE: the original disclosure misidentifies the conditions under which the uninitialized variable is used.  NOTE: the vendor disputes this issue, stating \" The 'length' variable is only uninitialized if 'auth_type' is neither the 'KERBEROS_V4' nor 'GSSAPI'; this condition cannot occur in the unmodified source code.","modified":"2026-09-01T20:02:48.925241860Z","published":"2007-12-06T02:46:00Z","upstream":["CVE-2007-5894"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2007-5894"}],"affected":[{"package":{"name":"krb5","ecosystem":"Debian:12","purl":"pkg:deb/debian/krb5?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.dfsg.4~beta1-1"}]}],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-5894.json"}},{"package":{"name":"krb5","ecosystem":"Debian:13","purl":"pkg:deb/debian/krb5?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.dfsg.4~beta1-1"}]}],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-5894.json"}},{"package":{"name":"krb5","ecosystem":"Debian:14","purl":"pkg:deb/debian/krb5?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.dfsg.4~beta1-1"}]}],"ecosystem_specific":{"urgency":"unimportant"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2007-5894.json"}}],"schema_version":"1.9.0"}