Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
[ GLSA 200803-31 ] MIT Kerberos 5: Multiple vulnerabilities
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index News & Announcements
View previous topic :: View next topic  
Author Message
GLSA
Veteran
Veteran


Joined: 12 May 2004
Posts: 1471

PostPosted: Mon Mar 24, 2008 8:26 pm    Post subject: [ GLSA 200803-31 ] MIT Kerberos 5: Multiple vulnerabilities Reply with quote

Gentoo Linux Security Advisory

Title: MIT Kerberos 5: Multiple vulnerabilities (GLSA 200803-31)
Severity: high
Exploitable: remote
Date: March 24, 2008
Bug(s): #199205, #212363
ID: 200803-31

Synopsis


Multiple vulnerabilities have been found in MIT Kerberos 5, which could
allow a remote unauthenticated user to execute arbitrary code with root
privileges.


Background


MIT Kerberos 5 is a suite of applications that implement the Kerberos
network protocol. kadmind is the MIT Kerberos 5 administration daemon,
KDC is the Key Distribution Center.


Affected Packages

Package: app-crypt/mit-krb5
Vulnerable: < 1.6.3-r1
Unaffected: >= 1.6.3-r1
Architectures: All supported architectures


Description

  • Two vulnerabilities were found in the Kerberos 4 support in
    KDC: A global variable is not set for some incoming message types,
    leading to a NULL pointer dereference or a double free()
    (CVE-2008-0062) and unused portions of a buffer are not properly
    cleared when generating an error message, which results in stack
    content being contained in a reply (CVE-2008-0063).
  • Jeff
    Altman (Secure Endpoints) discovered a buffer overflow in the RPC
    library server code, used in the kadmin server, caused when too many
    file descriptors are opened (CVE-2008-0947).
  • Venustech AD-LAB
    discovered multiple vulnerabilities in the GSSAPI library: usage of a
    freed variable in the gss_indicate_mechs() function (CVE-2007-5901) and
    a double free() vulnerability in the gss_krb5int_make_seal_token_v3()
    function (CVE-2007-5971).


Impact


The first two vulnerabilities can be exploited by a remote
unauthenticated attacker to execute arbitrary code on the host running
krb5kdc, compromise the Kerberos key database or cause a Denial of
Service. These bugs can only be triggered when Kerberos 4 support is
enabled.

The RPC related vulnerability can be exploited by a remote
unauthenticated attacker to crash kadmind, and theoretically execute
arbitrary code with root privileges or cause database corruption. This
bug can only be triggered in configurations that allow large numbers of
open file descriptors in a process.

The GSSAPI vulnerabilities could be exploited by a remote attacker to
cause Denial of Service conditions or possibly execute arbitrary code.


Workaround


Kerberos 4 support can be disabled via disabling the "krb4" USE flag
and recompiling the ebuild, or setting "v4_mode=none" in the
[kdcdefaults] section of /etc/krb5/kdc.conf. This will only work around
the KDC related vulnerabilities.


Resolution


All MIT Kerberos 5 users should upgrade to the latest version:
Code:
# emerge --sync
    # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.6.3-r1"


References

CVE-2007-5901
CVE-2007-5971
CVE-2008-0062
CVE-2008-0063
CVE-2008-0947


Last edited by GLSA on Fri Oct 26, 2012 4:25 am; edited 5 times in total
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index News & Announcements All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum