The MIT Kerberos krb524d daemon does not securely deallocate heap memory when handling an error condition, resulting in a double-free vulnerability. An unauthenticated, remote attacker could execute arbitrary code on a system running krb524d, which in many cases is also a Kerberos Distribution Center (KDC). The compromise of a KDC system can lead to the compromise of an entire Kerberos realm. An attacker may also be able to cause a denial of service on a system running krb524d.
As described on the MIT Kerberos web site: "Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography." MIT Kerberos code is used in network applications from a variety of different vendors and is included in many UNIX and Linux distributions.
The MIT Kerberos krb524d daemon converts Kerberos 5 service tickets into Kerberos 4 service tickets. There is a double-free vulnerability in krb524d that can be triggered during the conversion of a cross-realm ticket. From MITKRB5-SA-2004-002:
An unauthenticated, remote attacker to could execute arbitrary code on a system running krb524d. In many cases, this system also operates a KDC, so this vulnerability could allow an attacker to gain the master secret for a Kerberos realm, leading to compromise of the entire realm. An attacker may also be able to crash a system running krb524d, causing a denial of service.
Apply a patch
Apply the appropriate patch(es) referenced in MITKRB5-SA-2004-002 or specified by your vendor.
Thanks to Tom Yu and the MIT Kerberos Development Team for reporting this vulnerability and coordinating with vendors. MITKRB5-SA-2004-002 acknowledges Marc Horowitz.
This document was written by Art Manion.
|Date First Published:||2004-09-02|
|Date Last Updated:||2004-09-03 20:22 UTC|