[heimdal] [CVE-2007-5939] possible remote vulnerability of unknown impact via an invalid username

[disabled.user]

Binary package hint: heimdal-dev

References:
[1] MDKSA-2007:239 (http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:239)
[2] CVE-2007-5939 (http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5939)

Quoting [1]:
"It was found that the gss_userok() function in Heimdal 0.7.2 did not allocate memory for the ticketfile pointer before calling free(), which could possibly allow remote attackers to have an unknown impact via an invalid username. It is uncertain whether or not this is exploitable, however packages are being provided regardless."

Quoting [2]:
"The gss_userok function in appl/ftp/ftpd/gss_userok.c in Heimdal 0.7.2 does not allocate memory for the ticketfile pointer before calling free, which allows remote attackers to have an unknown impact via an invalid username. NOTE: the vulnerability was originally reported for ftpd.c, but this is incorrect."

[Scott Kitterman (kitterman)]

Version in Hardy not affected.

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[LumpyCustard (orangelumpycustard)]

Please close for Feisty as Won't Fix? This goes for all the other Feisty bugs.

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Sergio Zanchetta (primes2h)]

The 18 month support period for Gutsy Gibbon 7.10 has reached its end of life -
http://www.ubuntu.com/news/ubuntu-7.10-eol . As a result, we are closing the
Gutsy task.