Kerberos kadmind Stack Overflow and Uninitialized Pointer Lets Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018647
|
|
SecurityTracker URL: http://securitytracker.com/id?1018647
|
|
CVE Reference: CVE-2007-3999
, CVE-2007-4000
, CVE-2007-4743
(Links to External Site)
|
Updated: Sep 7 2007
|
Original Entry Date: Sep 4 2007
|
Impact: Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): krb5-1.4 through krb5-1.6.2
|
Description: Two vulnerabilities were reported in Kerberos. A remote user can execute arbitrary code on the target system.
A remote user can send specially crafted data to trigger a stack overflow in the krb5 Kerberos administration daemon (kadmind) in
RPCSEC_GSS authentication RPC library [CVE-2007-3999]. Arbitrary code can be executed on the target system, typically with root
privileges.
Third-party applications that use the RPC library may be affected.
Tenable Network Security reported this vulnerability
via TippingPoint.
A remote authenticated user with 'modify policy' privileges can exploit an uninitialized pointer in kadmind
to write arbitrary data to memory [CVE-2007-4000]. Arbitrary code can be executed on the target system, typically with root privileges.
Garrett
Wollman of MIT CSAIL reported this vulnerability.
|
Impact: A remote user can execute arbitrary code on the target system with root privileges.
|
Solution: The vendor has issued a patch, available in their advisory.
On September 5, 2007, the vendor reported that the original patch
for svc_auth_gss.c [CVE-2007-3999] itself contained a buffer overflow. This new vulnerability was assigned CVE number CVE-2007-4743.
The advisory has been updated to include a corrected patch. The vendor credits Kevin Coffman (UMich), Will Fiveash (Sun), and
Nico Williams (Sun) with discovering the flaw in the original patch.
The fix will be included in the upcoming krb5-1.6.3 release.
The
Kerberos advisory is available at:
http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt
|
Vendor URL: web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
