SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Security)  >   Kerberos Vendors:   MIT
Kerberos kadmind Stack Overflow and Uninitialized Pointer Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1018647
SecurityTracker URL:  http://securitytracker.com/id/1018647
CVE Reference:   CVE-2007-3999, CVE-2007-4000, CVE-2007-4743   (Links to External Site)
Updated:  Sep 7 2007
Original Entry Date:  Sep 4 2007
Impact:   Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): krb5-1.4 through krb5-1.6.2
Description:   Two vulnerabilities were reported in Kerberos. A remote user can execute arbitrary code on the target system.

A remote user can send specially crafted data to trigger a stack overflow in the krb5 Kerberos administration daemon (kadmind) in RPCSEC_GSS authentication RPC library [CVE-2007-3999]. Arbitrary code can be executed on the target system, typically with root privileges.

Third-party applications that use the RPC library may be affected.

Tenable Network Security reported this vulnerability via TippingPoint.

A remote authenticated user with 'modify policy' privileges can exploit an uninitialized pointer in kadmind to write arbitrary data to memory [CVE-2007-4000]. Arbitrary code can be executed on the target system, typically with root privileges.

Garrett Wollman of MIT CSAIL reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system with root privileges.
Solution:   The vendor has issued a patch, available in their advisory.

On September 5, 2007, the vendor reported that the original patch for svc_auth_gss.c [CVE-2007-3999] itself contained a buffer overflow. This new vulnerability was assigned CVE number CVE-2007-4743. The advisory has been updated to include a corrected patch. The vendor credits Kevin Coffman (UMich), Will Fiveash (Sun), and Nico Williams (Sun) with discovering the flaw in the original patch.

The fix will be included in the upcoming krb5-1.6.3 release.

The Kerberos advisory is available at:

http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt

Vendor URL:  web.mit.edu/Kerberos/advisories/MITKRB5-SA-2007-006.txt (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Sep 4 2007 (Red Hat Issues Fix) Kerberos kadmind Stack Overflow and Uninitialized Pointer Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 5.
Sep 6 2007 (Sun Issues Fix for Solaris) Kerberos kadmind Stack Overflow and Uninitialized Pointer Lets Remote Users Execute Arbitrary Code
Sun has issued IDRs for Solaris 8, 9, and 10.
Sep 7 2007 (Red Hat Issues Fix for the Vulnerability in the Original Patch) Kerberos kadmind Stack Overflow and Uninitialized Pointer Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for Red Hat Enterprise Linux 5.
Sep 19 2007 (Red Hat Issues Fix for nfs-utils) Kerberos kadmind Stack Overflow and Uninitialized Pointer Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for nfs-utils-lib on Red Hat Enterprise Linux 4.
Oct 2 2007 (Red Hat Issues Fix for nfs-utils) Kerberos kadmind Stack Overflow and Uninitialized Pointer Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix for nfs-utils on Red Hat Enterprise Linux 5.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC