Vulnerability Note VU#602625

KTH Kerberos environment variables krb4proxy and KRBCONFDIR may be used insecurely

KRBCONFDIR environment variable

The first environment variable is KRBCONFDIR, which allows the intruder to cause the client program to use different Kerberos configuration data for authentication. The intruder is able to control which KDC is contacted and supply a new secret key in a malicious srvtab file. Because the intruder controls this new secret key they can have the malicious server construct a properly formatted authentication response using the new secret that will pass the cryptographic checks for verifying the server's identity. The legitimate srvtab secret is not compromised, and the client program must be compiled with Kerberos support. The attacker must have write access to a filesystem mounted on the victim host in order to execute this attack. Local attackers may not exploit this vulnerability by setting the environment variable in their shell because the programs attempt to detect the setuid status and ignore the KRBDCONFDIR variable.

krb4_proxy environment variable

The other variable is krb4_proxy, which allows a client to specify a proxy server for Kerberos client authentication. The client application must be compiled with Kerberos support, and the client system must be configured to use Kerberos authentication. Because the client code is expecting an authentication response proxied form a legitimate server, the intruder must overcome the cryptographic checks for verifying the server's identity in some other way. Access to the legitimate srvtab or weak checking by the client code may allow this.

Depending on the configuration of a client side compilation directive called KLOGIN_PARANOID, the client code may or may not detect that the authentication response is not from a legitimate server. If the buffer overflow described in VU#759265 can be successfully exploited, the setting of this compilation directive does not matter. The attacker does not have to have write access to any local filesystems to exploit this vulnerability.

II. Impact

The KRBCONFDIR environment variable issue may be exploited by local or remote intruders to gain root privileges.

krb4_proxy environment variable

The krb4_proxy environment variable vulnerability may be exploited by local or remote intruders to gain root privileges depending on several other factors such as the KLOGIN_PARANOID compilation directive.

III. Solution

Systems Affected

http://www.securityfocus.com/bid/2090
http://www.securityfocus.com/bid/2092

Credit

Thanks to Jouko Pynnönen for reporting this vulnerability to the CERT/CC, and to Assar Westerlund for assisting in the development of this document.

This document was written by Cory F Cohen.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.