Vulnerability Note VU#795632

MIT Kerberos 5 ASN.1 decoding functions insecurely deallocate memory (double-free)

Kerberos 5 protocol messages are defined using Abstract Syntax Notation One (ASN.1). When ASN.1 decoding functions in the MIT Kerberos 5 library handle error conditions, the functions free() a memory reference and return the reference to the calling function. In some cases, error handling code in the calling functions may free() the memory reference again, resulting in a double-free vulnerability. MITKRB5-SA-2004-002 explains in more detail:

In the MIT krb5 library, in all releases up to and including
krb5-1.3.4, ASN.1 decoder functions and their callers do not use a
consistent set of memory management conventions.  The callers expect
the decoders to allocate memory.  The callers typically have
error-handling code which frees memory allocated by the ASN.1 decoders
if pointers to the allocated memory are non-null.  Upon encountering
error conditions, the ASN.1 decoders themselves free memory which they
have allocated, but do not null the corresponding pointers.  When some
library functions receive errors from the ASN.1 decoders, they attempt
to pass the non-null pointer (which points to freed memory) to free(),
causing a double-free.

In all releases of MIT krb5 up to and including krb5-1.3.4, cleanup
code in the KDC frees memory returned by ASN.1 decoders.  This cleanup
code only frees memory pointed to by non-null pointers, but if an
ASN.1 decoder returns an error, the cleanup code will free memory
previously freed by the decoder.

Apply the appropriate patch(es) referenced in MITKRB5-SA-2004-002 or specified by your vendor.

Upgrade

According to MITKRB5-SA-2004-002, "The upcoming krb5-1.3.5 release will contain fixes for these problems."

Restrict access

Depending on network architecture, it may be practical to restrict access to KDC servers (88/udp) from untrusted networks such as the Internet. Due to network application requirements, it may be possible, but less practical, to limit access from Kerberos clients to trusted KDC and application servers. While these workarounds will help to limit the source of attacks, they will not prevent attacks from trusted hosts or networks or attackers who can successfully spoof their source addresses.

Systems Affected

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-002-dblfree.txt
http://web.mit.edu/kerberos/www/
http://web.mit.edu/kerberos/www/krb5-1.3/
http://www.cmf.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html#asn1
http://www.itu.int/ITU-T/asn1/
http://www.itu.int/ITU-T/studygroups/com10/languages/
http://www.cmf.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html#kerbfirewall
http://www.securitytracker.com/alerts/2004/Aug/1011106.html

Credit

Thanks to Tom Yu and the MIT Kerberos Development Team for reporting this vulnerability and coordinating with vendors. MITKRB5-SA-2004-002 acknowledges Will Fiveash and Nico Williams.

This document was written by Art Manion.

Other Information

If you have feedback, comments, or additional information about this vulnerability, please send us email.