CVE-2004-1189

The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.

• CWE-787

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000917Broken Link
• http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.htmlMailing List, Third Party Advisory
• http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.htmlMailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=110358420909358&w=2Issue Tracking, Mailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=110548298407590&w=2Issue Tracking, Mailing List, Third Party Advisory
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txtPatch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2004:156Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2005-012.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2005-045.htmlThird Party Advisory
• http://www.trustix.org/errata/2004/0069Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18621Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11911Broken Link, Third Party Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000917Broken Link
• http://lists.apple.com/archives/security-announce/2005//Aug/msg00001.htmlMailing List, Third Party Advisory
• http://lists.apple.com/archives/security-announce/2005/Aug/msg00000.htmlMailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=110358420909358&w=2Issue Tracking, Mailing List, Third Party Advisory
• http://marc.info/?l=bugtraq&m=110548298407590&w=2Issue Tracking, Mailing List, Third Party Advisory
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txtPatch, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2004:156Third Party Advisory
• http://www.redhat.com/support/errata/RHSA-2005-012.htmlThird Party Advisory
• http://www.redhat.com/support/errata/RHSA-2005-045.htmlThird Party Advisory
• http://www.trustix.org/errata/2004/0069Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18621Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11911Broken Link, Third Party Advisory

Published

Dec 31, 2004

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2004-1183Integer overflow in the tiffdump utility for libtiff 3.7.1 a…
• CVE-2004-1184The EPSF pipe support in enscript 1.6.3 allows remote attack…
• CVE-2004-1185Enscript 1.6.3 does not sanitize filenames, which allows rem…
• CVE-2004-1186Multiple buffer overflows in enscript 1.6.3 allow remote att…
• CVE-2004-1187Heap-based buffer overflow in the pnm_get_chunk function for…
• CVE-2004-1188The pnm_get_chunk function in xine 0.99.2 and earlier, and o…
• CVE-2004-1190SUSE Linux before 9.1 and SUSE Linux Enterprise Server befor…
• CVE-2004-1191Race condition in SuSE Linux 8.1 through 9.2, when run on SM…
• CVE-2004-1192Format string vulnerability in the lprintf function in Citad…
• CVE-2004-1193Prevx Home 1.0 allows local users with administrator privile…
• CVE-2004-1194Buffer overflow in Star Wars Battlefront 1.11 and earlier al…
• CVE-2004-1195Star Wars Battlefront 1.11 and earlier allows remote attacke…