SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips
 

Vulnerability Note VU#895609

MIT Kerberos krb4-enabled KDC contains multiple vulnerabilities

Overview

Vulnerabilities in the MIT Kerberos Key Distribution Center server could allow a remote attacker to compromise the key database, gain access to sensitive information, or cause a denial of service.

I. Description

Several vulnerabilities exist in the Authentication Service and Key Distribution Center server (krb5kdc) included in the MIT krb5 Kerberos implementation. In one case, the use of a null or dangling pointer in the KDC can result in a crash or double-free, and may leak portions of process memory to an attacker. In another case, uninitialized stack values cause reuse of a small window of previous stack values to be interpreted as message content. Some of this content may be returned to the attacker as part of an error response.

These vulnerabilities are only exposed if Kerberos 4 support is enabled. MIT notes that by default, Kerberos 4 support is compiled in but not enabled in recent versions of the software. MIT also notes that no other client or application server programs are affected.

II. Impact

An unauthenticated remote attacker may cause a krb4-enabled KDC server to crash, expose information (potentially including secret key data), or execute arbitrary code with the privileges of the krb5kdc. Secondary impacts include compromise of the Kerberos key database and denial of service to clients attempting to authenticate in the affected Kerberos realm.

III. Solution

Upgrade or apply a patch from the vendor


Patches have been released to address these issues. Please see the Systems Affected section of this document for more details.

Systems Affected

VendorStatusDate Updated
3com, Inc.Unknown6-Mar-2008
AlcatelUnknown6-Mar-2008
Apple Computer, Inc.Vulnerable18-Mar-2008
AT&TUnknown6-Mar-2008
Avaya, Inc.Unknown6-Mar-2008
Avici Systems, Inc.Unknown6-Mar-2008
Borderware TechnologiesUnknown6-Mar-2008
Check Point Software TechnologiesUnknown6-Mar-2008
Cisco Systems, Inc.Not Vulnerable10-Mar-2008
ClavisterUnknown6-Mar-2008
Computer AssociatesNot Vulnerable18-Mar-2008
Computer Associates eTrust Security ManagementUnknown6-Mar-2008
Conectiva Inc.Unknown6-Mar-2008
Cray Inc.Unknown6-Mar-2008
D-Link Systems, Inc.Unknown6-Mar-2008
Data Connection, Ltd.Unknown6-Mar-2008
Debian GNU/LinuxUnknown6-Mar-2008
EMC CorporationUnknown6-Mar-2008
Engarde Secure LinuxUnknown6-Mar-2008
Enterasys NetworksUnknown6-Mar-2008
EricssonUnknown6-Mar-2008
eSoft, Inc.Unknown6-Mar-2008
Extreme NetworksUnknown6-Mar-2008
F5 Networks, Inc.Unknown6-Mar-2008
Fedora ProjectUnknown6-Mar-2008
Force10 Networks, Inc.Unknown6-Mar-2008
Fortinet, Inc.Unknown6-Mar-2008
Foundry Networks, Inc.Unknown6-Mar-2008
FreeBSD, Inc.Unknown6-Mar-2008
FujitsuUnknown6-Mar-2008
Global Technology AssociatesUnknown6-Mar-2008
Hewlett-Packard CompanyUnknown6-Mar-2008
HitachiUnknown6-Mar-2008
HyperchipUnknown6-Mar-2008
IBM CorporationUnknown6-Mar-2008
IBM Corporation (zseries)Unknown6-Mar-2008
IBM eServerUnknown6-Mar-2008
Ingrian Networks, Inc.Unknown6-Mar-2008
Intel CorporationNot Vulnerable10-Mar-2008
Internet Security Systems, Inc.Unknown6-Mar-2008
IntotoNot Vulnerable10-Mar-2008
IP Infusion, Inc.Unknown6-Mar-2008
Juniper Networks, Inc.Not Vulnerable3-Apr-2008
Linksys (A division of Cisco Systems)Unknown6-Mar-2008
Lucent TechnologiesUnknown6-Mar-2008
Luminous NetworksUnknown6-Mar-2008
Mandriva, Inc.Unknown6-Mar-2008
McAfeeUnknown6-Mar-2008
Microsoft CorporationNot Vulnerable3-Apr-2008
MIT Kerberos Development TeamVulnerable18-Mar-2008
MontaVista Software, Inc.Unknown6-Mar-2008
Multinet (owned Process Software Corporation)Unknown6-Mar-2008
Multitech, Inc.Unknown6-Mar-2008
NEC CorporationUnknown6-Mar-2008
NetBSDUnknown6-Mar-2008
Network Appliance, Inc.Unknown6-Mar-2008
NextHop Technologies, Inc.Unknown6-Mar-2008
Nortel Networks, Inc.Unknown6-Mar-2008
Novell, Inc.Unknown6-Mar-2008
Openwall GNU/*/LinuxUnknown6-Mar-2008
QNX, Software Systems, Inc.Unknown6-Mar-2008
QuaggaUnknown6-Mar-2008
Red Hat, Inc.Unknown6-Mar-2008
Redback Networks, Inc.Unknown6-Mar-2008
Riverstone Networks, Inc.Unknown6-Mar-2008
Secure Computing Network Security DivisionNot Vulnerable10-Mar-2008
Silicon Graphics, Inc.Unknown6-Mar-2008
Slackware Linux Inc.Unknown6-Mar-2008
Sony CorporationUnknown6-Mar-2008
StonesoftUnknown6-Mar-2008
Sun Microsystems, Inc.Not Vulnerable18-Mar-2008
SUSE LinuxUnknown6-Mar-2008
Symantec, Inc.Unknown6-Mar-2008
The SCO GroupUnknown6-Mar-2008
TippingPoint, Technologies, Inc.Not Vulnerable18-Mar-2008
Trustix Secure LinuxUnknown6-Mar-2008
TurbolinuxUnknown6-Mar-2008
UbuntuVulnerable19-Mar-2008
UnisysUnknown6-Mar-2008
Watchguard Technologies, Inc.Unknown6-Mar-2008
Wind River Systems, Inc.Unknown6-Mar-2008
ZyXELUnknown6-Mar-2008

References


http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-001.txt

Credit

Thanks to Ken Raeburn of the MIT Kerberos Team for reporting this vulnerability.

This document was written by Chad R Dougherty.

Other Information

Date Public03/18/2008
Date First Published03/18/2008 09:56:56 PM
Date Last Updated04/03/2008
CERT Advisory 
CVE NameCVE-2008-0062; CVE-2008-0063
US-CERT Technical Alerts 
Metric10.10
Document Revision10

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2008 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader