Vulnerability Note VU#481564
Kerberos administration daemon fails to properly initialize function pointers
The Kerberos administration daemon fails to properly initialize pointers. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service.
A vulnerability exists in the way the Kerberos administration daemon handles pointers that may allow a remote, unauthenticated user to execute arbitrary code. According to MIT krb5 Security Advisory 2006-002:
The Kerberos administration daemon, "kadmind", can execute arbitrary code by calling through a function pointer located in freed memory. This vulnerability results from bugs in the server-side portion of the RPC library.
Note that krb5-1.4 through krb5-1.4.4, and krb5-1.5 through krb5-1.5.1 are affected by this vulnerability. Other server applications that utilize the RPC library provided with MIT krb5 may also be affected.
This vulnerability can be triggered by sending a specially crafted Kerberos packet to a vulnerable system.
A remote, unauthenticated user may be able to execute arbitrary code resulting in the compromise of the Kerberos key database or cause a denial of service.
Systems Affected (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Debian GNU/Linux||Affected||04 Jan 2007||19 Jan 2007|
|Fedora Project||Affected||04 Jan 2007||11 Jan 2007|
|Gentoo Linux||Affected||04 Jan 2007||07 Feb 2007|
|Mandriva, Inc.||Affected||04 Jan 2007||11 Jan 2007|
|MIT Kerberos Development Team||Affected||04 Jan 2007||09 Jan 2007|
|OpenPKG||Affected||-||11 Jan 2007|
|rPath||Affected||-||12 Jan 2007|
|Slackware Linux Inc.||Affected||04 Jan 2007||19 Jan 2007|
|SUSE Linux||Affected||04 Jan 2007||11 Jan 2007|
|Trustix Secure Linux||Affected||04 Jan 2007||19 Jan 2007|
|Ubuntu||Affected||04 Jan 2007||16 Jan 2007|
|AttachmateWRQ, Inc.||Not Affected||04 Jan 2007||07 Feb 2007|
|CyberSafe, Inc.||Not Affected||04 Jan 2007||05 Jan 2007|
|Force10 Networks, Inc.||Not Affected||04 Jan 2007||10 May 2007|
|Hitachi||Not Affected||04 Jan 2007||16 Jan 2007|
CVSS Metrics (Learn More)
This issue is addressed in MIT krb5 Security Advisory 2006-002. MIT credits Andrew Korty from Indiana University for reporting this issue.
This document was written by Chris Taschner.
- CVE IDs: CVE-2006-6143
- Date Public: 09 Jan 2007
- Date First Published: 09 Jan 2007
- Date Last Updated: 10 May 2007
- Severity Metric: 20.92
- Document Revision: 55
If you have feedback, comments, or additional information about this vulnerability, please send us email.