(Conectiva Issues Fix) Kerberos 5 KDC Double-Free Errors May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1012720 |
|
SecurityTracker URL: http://securitytracker.com/id/1012720
|
|
CVE Reference:
CAN-2004-0642, CAN-2004-0643, CAN-2004-0772
(Links to External Site)
|
Date: Dec 29 2004
|
Impact:
Execution of arbitrary code via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 1.3.4 and prior versions
|
Description:
Several double-free vulnerabilities were reported in the Kerberos 5 Key Distribution Center (KDC) software. A remote user may be able to execute arbitrary code and compromise the Kerberos domain.
The vendor reported that the ASN.1 decoder functions use inconsistent memory management conventions. Under certain error conditions, the ASN.1 decoders may free memory without nulling the corresponding pointers [CVE: CAN-2004-0642]. As a result, some library functions that receive errors from from the ASN.1 decoders may attempt to free the non-null pointers.
It is also reported that krb5_rd_cred() in versions prior to 1.3.2 frees already-freed buffers returned by the decode_krb5_enc_cred_part() function when an error is returned [CVE: CAN-2004-0643].
It is also reported that a patch introduced in version 1.2.8 to disable krb4 cross-realm authentication in krb524d contains a double-free vulnerability [CVE: CAN-2004-0772].
The vendor credits Will Fiveash and Nico Williams at Sun, Marc Horowitz, Nalin Dahyabhai, Joseph Galbraith, and John Hawkinson with discovering these flaws.
|
Impact:
A remote user may be able to execute arbitrary code on a target KDC system. This will compromise the entire Kerberos realm.
A reomte user may be able to execute arbitrary code on a target system running krb524d.
A remote user acting as a KDC or application server may be able to execute arbitrary code on a target client host while the client is authenticating.
|
Solution:
Conectiva has released a fix.
ftp://atualizacoes.conectiva.com.br/10/SRPMS/krb5-1.3.3-62470U10_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-server-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-apps-servers-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-devel-static-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-client-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-doc-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-devel-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-apps-clients-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/krb5-1.2.7-28721U90_3cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-devel-static-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-devel-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-client-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-doc-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-apps-clients-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-apps-servers-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-server-1.2.7-28721U90_3cl.i386.rpm
|
Vendor URL: web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt (Links to External Site)
|
Cause:
State error
|
Underlying OS:
Linux (Conectiva)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 9 Sep 2004 20:54:06 -0300
Subject: [Conectiva-updates] [CLA-2004:860] Conectiva Security Announcement
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : krb5
SUMMARY : Multiple vulnerabilities in Kerberos 5
DATE : 2004-09-09 20:53:00
ID : CLA-2004:860
RELEVANT
RELEASES : 9, 10
- -------------------------------------------------------------------------
DESCRIPTION
The "krb5" packages are MIT's[1] implementation of the Kerberos 5
authentication protocol.
This announcement fixes several vulnerabilities listed in the
advisories MITKRB5-SA-2004-001[2], MITKRB5-SA-2004-002[3] and
MITKRB5-SA-2004-003[4]:
1. Buffer overflows in krb5_aname_to_localname() (CAN-2004-0523[5])
The krb5_aname_to_localname() library function contains multiple
buffer overflows vulnerabilities[5] which could be exploited to gain
unauthorized root access. Exploitation of these flaws requires an
unusual combination of factors, including successful authentication
to a vulnerable service and a non-default configuration on the target
service. This announcement updates the correction used to the patch
provided by Bill Dodd.
2. Several double-free vulnerabilities in KDC and libraries
(CAN-2004-0642[6], CAN-2004-0643[7], CAN-2004-0772[8])
The MIT Kerberos 5 implementation's Key Distribution Center (KDC)
program contains a double-free vulnerability that potentially allows
a remote attacker to execute arbitrary code. Additionally,
double-free vulnerabilities exist in MIT Kerberos 5 library code,
making client programs and application servers vulnerable. The
vulnerability in krb524d was discovered by Marc Horowitz; the other
double-free vulnerabilities were discovered by Will Fiveash and Nico
Williams
at Sun.
3. ASN.1 decoder denial of service (CAN-2004-0644[9])
Will Fiveash and Nico Williams also found a denial-of-service
vulnerability[9] in the ASN.1 decoder library in the MIT Kerberos 5
distribution which could lead to an infinite loop in the decoder,
allowing an unauthenticated remote attacker to cause a KDC or
application server to hang inside an infinite loop and an attacker
impersonating a legitimate KDC or application server to cause a
client program to hang inside an infinite loop.
SOLUTION
It is recommended that all Kerberos users in Conectiva Linux upgrade
their packages. Please note that the service will be automatically
restarted after the upgrade if it was already running.
Several applications can make use of the Kerberos libraries. Those
applications have to be restarted as well.
REFERENCES
1.http://web.mit.edu/Kerberos/www/index.html
2.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2004-001-an_to_ln.txt
3.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt
4.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2004-003-asn1.txt
5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0523
6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0642
7.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0643
8.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0772
9.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0644
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/krb5-1.3.3-62470U10_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-server-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-apps-servers-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-devel-static-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-client-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-doc-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-devel-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/krb5-apps-clients-1.3.3-62470U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/krb5-1.2.7-28721U90_3cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-devel-static-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-devel-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-client-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-doc-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-apps-clients-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-apps-servers-1.2.7-28721U90_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/krb5-server-1.2.7-28721U90_3cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQFBQO0d42jd0JmAcZARAhQWAJ9XTIOwgf+6dapxACFPabt64qBWdACdHjsx
KFGcVXgw29vt/C5QdBBRh/o=
=RNsz
-----END PGP SIGNATURE-----
______________________________________________________________________
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
|
|
