Vulnerability Note VU#365313

MIT Kerberos kadmind RPC library gssrpc__svcauth_unix() integer conversion error

The function gssrpc__svcauth_unix() in src/lib/rpc/svc_auth_unix.c stores an unsigned integer obtained from IXDR_GET_U_LONG into a signed integer variable "str_len". Subsequently, it checks that "str_len" is less than MAX_MACHINE_NAME, which will always be true of "str_len" is negative, which can happen when a large unsigned integer is converted to a signed integer. Once the length check succeeds, gssrpc__svcauth_unix() calls memmove() with a length of "str_len" with the target in a stack buffer.

This vulnerability is believed to be difficult to exploit because the memmove() implementation receives a very large number (a negative integer converted to a large unsigned value), which will almost certainly cause some sort of memory access fault prior to returning. This probably avoids any usage of the corrupted return address in the overwritten stack frame. Note that some (perhaps unlikely) memmove() implementations may call other procedures and thus may be vulnerable to corrupted return addresses.

A patch can be obtained from MIT krb5 Security Advisory MITKRB5-SA-2007-004. MIT also states that this will be addressed in the upcoming krb5-1.6.2 and krb5-1.5.4 releases. Please check with your vendor for third-party product updates.

Systems Affected

https://www.securecoding.cert.org/confluence/display/seccode/INT31-C.+Ensure+that+integer+conversions+do+not+result+in+lost+or+misinterpreted+data
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-004.txt
http://www.ubuntu.com/usn/usn-477-1
http://www.mandriva.com/security/advisories?name=MDKSA-2007:137
http://secunia.com/advisories/25800/
http://secunia.com/advisories/26033/
http://docs.info.apple.com/article.html?artnum=306172

Credit

Thanks to MIT for reporting this vulnerability, who in turn credit Wei Wang of McAfee Avert Labs.

This document was written by Will Dormann.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.