Vulnerability Note VU#885830

MIT Kerberos 5 allows unauthenticated attacker to cause MIT krb5 Key Distribution Center to overflow a heap buffer by one byte

Overview

Unauthenticated attacker can cause MIT krb5 Key Distribution Center (KDC) to overflow a heap buffer by one byte, possibly leading to arbitrary code execution.

I. Description

Kerberos is a network authentication system which uses a trusted third party (a KDC) to authenticate clients and servers to each other. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. MIT Kerberos code is used in network applications from a variety of different vendors and is included in many UNIX and Linux distributions.

The MIT krb5 Security Advisory 2005-002 issued 2005 July 12, available from
<http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-002-kdc.txt> indicates:

When an MIT krb5 Key Distribution Center (KDC) implementation receives a certain unlikely (but valid) request via a TCP or UDP connection it can trigger a bug in the krb5 library which results in a single-byte overflow of a heap buffer. Application servers are vulnerable to a highly improbable attack, provided that the attacker controls a realm sharing a cross-realm key with the target realm.

II. Impact

An unauthenticated attacker may be able to use this vulnerability to execute arbitrary code on the KDC host, potentially compromising an entire Kerberos realm. No exploit code is known to exist at this time. According to the MIT krb5 Security Advisory 2005-002 this vulnerability affects KDC implementations and application servers in all MIT krb5 releases, up to and including krb5-1.4.1. Third-party application servers which use MIT krb5 are also affected.

III. Solution

Apply patches available from your vendor. Details of the patch are also available from

http://web.mit.edu/kerberos/advisories/2005-002-patch_1.4.1.txt

Systems Affected

Vendor	Status	Date Notified
Apple Computer Inc.	Unknown	10-May-2005
Apple Computer Inc.	Unknown	10-May-2005
Conectiva	Unknown	10-May-2005
Cray Inc.	Unknown	17-May-2005
Debian	Unknown	17-May-2005
EMC Corporation	Unknown	17-May-2005
Engarde	Unknown	17-May-2005
F5 Networks	Not Vulnerable	27-May-2005
FreeBSD	Unknown	17-May-2005
Fujitsu	Unknown	17-May-2005
Hitachi	Unknown	17-May-2005
HP	Unknown	17-May-2005
IBM	Unknown	10-May-2005
Immunix	Unknown	17-May-2005
Ingrian Networks	Unknown	17-May-2005
Juniper Networks	Not Vulnerable	21-Jun-2005
KTH Kerberos	Unknown	17-May-2005
MandrakeSoft	Unknown	17-May-2005
Microsoft Corporation	Not Vulnerable	19-May-2005
MontaVista Software	Unknown	17-May-2005
NEC Corporation	Unknown	17-May-2005
NetBSD	Unknown	17-May-2005
Nokia	Unknown	17-May-2005
Novell	Unknown	17-May-2005
Openwall GNU/*/Linux	Unknown	17-May-2005
QNX	Unknown	17-May-2005
Red Hat Inc.	Vulnerable	11-Jul-2005
SCO	Unknown	10-May-2005
SGI	Unknown	17-May-2005
Sony Corporation	Unknown	17-May-2005
Sun Microsystems Inc.	Vulnerable	13-Jul-2005
SuSE Inc.	Unknown	17-May-2005
TurboLinux	Unknown	17-May-2005
Unisys	Unknown	17-May-2005
Wind River Systems Inc.	Unknown	10-May-2005
WRQ	Unknown	17-May-2005

References

http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-002-kdc.txt
http://web.mit.edu/kerberos/advisories/2005-002-patch_1.4.1.txt

Credit

This vulnerability was reported by the MIT Kerberos Development Team. The MIT Kerberos Development Team thank Daniel Wachdorf for reporting this vulnerability.

This document was written by Robert Mead based on information in the MIT krb5 Security Advisory 2005-002.

Other Information

Date Public:	2005-07-12
Date First Published:	2005-07-13
Date Last Updated:	2005-07-13
CERT Advisory:
CVE-ID(s):	CAN-2005-1175
NVD-ID(s):	CAN-2005-1175
US-CERT Technical Alerts:
Metric:	4.63
Document Revision:	16

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader