Vulnerability Note VU#580124

MIT Kerberos (krb5) krshd and v4rcp do not properly validate setuid() or seteuid() calls

From MIT krb5 Security Advisory 2006-001:

The following vulnerabilities may result from unchecked calls to setuid(), and are believed to only exist on Linux and AIX:

• Unchecked calls to setuid() in krshd may allow a local privilege escalation leading to execution of programs as root.
  
• Unchecked calls to setuid() in the v4rcp may allow a local privilege escalation leading to reading, writing, or creating files as root. v4rcp is the remote end of a krb4-authenticated rcp operation, but may be executed directly by an attacker, as it is a setuid program.

From MIT krb5 Security Advisory 2006-001: "The upcoming krb5-1.5.1 and krb5-1.4.4 releases will include fixes for these vulnerabilities." MIT has also released patches for krb 5-1.5 and krb5-1.4.3. See the Systems Affected section of this document for information about specific vendors.

Disable vulnerable programs

From MIT krb5 Security Advisory 2006-001: "Disable krshd and v4rcp, and remove the setuid bit from the ksu binary and the ftpd binary."

Systems Affected

http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-001-setuid.txt
http://www.die.net/doc/linux/man/man8/kshd.8.html
http://www.die.net/doc/linux/man/man1/v4rcp.1.html

Credit

These vulnerabilities were reported by the MIT Kerberos Development Team.

This document was written by Ryan Giobbi and Art Manion.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.