the original cloud security

Gentoo Linux Security Advisory 200803-31

Gentoo Linux Security Advisory 200803-31
Posted Mar 24, 2008
Authored by Gentoo | Site security.gentoo.org

Gentoo Linux Security Advisory GLSA 200803-31 - Two vulnerabilities were found in the Kerberos 4 support in KDC: A global variable is not set for some incoming message types, leading to a NULL pointer dereference or a double free() and unused portions of a buffer are not properly cleared when generating an error message, which results in stack content being contained in a reply. Versions less than 1.6.3-r1 are affected.

tags | advisory, vulnerability
systems | linux, gentoo
advisories | CVE-2007-5901, CVE-2007-5971, CVE-2008-0062, CVE-2008-0063, CVE-2008-0947
MD5 | d97e73211f5b32866700162abb9e1ca9

Gentoo Linux Security Advisory 200803-31

Change Mirror Download
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200803-31
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: High
Title: MIT Kerberos 5: Multiple vulnerabilities
Date: March 24, 2008
Bugs: #199205, #212363
ID: 200803-31

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilites have been found in MIT Kerberos 5, which could
allow a remote unauthenticated user to execute arbitrary code with root
privileges.

Background
==========

MIT Kerberos 5 is a suite of applications that implement the Kerberos
network protocol. kadmind is the MIT Kerberos 5 administration daemon,
KDC is the Key Distribution Center.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-crypt/mit-krb5 < 1.6.3-r1 >= 1.6.3-r1

Description
===========

* Two vulnerabilities were found in the Kerberos 4 support in KDC: A
global variable is not set for some incoming message types, leading
to a NULL pointer dereference or a double free() (CVE-2008-0062) and
unused portions of a buffer are not properly cleared when generating
an error message, which results in stack content being contained in a
reply (CVE-2008-0063).

* Jeff Altman (Secure Endpoints) discovered a buffer overflow in the
RPC library server code, used in the kadmin server, caused when too
many file descriptors are opened (CVE-2008-0947).

* Venustech AD-LAB discovered multiple vulnerabilities in the GSSAPI
library: usage of a freed variable in the gss_indicate_mechs()
function (CVE-2007-5901) and a double free() vulnerability in the
gss_krb5int_make_seal_token_v3() function (CVE-2007-5971).

Impact
======

The first two vulnerabilities can be exploited by a remote
unauthenticated attacker to execute arbitrary code on the host running
krb5kdc, compromise the Kerberos key database or cause a Denial of
Service. These bugs can only be triggered when Kerberos 4 support is
enabled.

The RPC related vulnerability can be exploited by a remote
unauthenticated attacker to crash kadmind, and theoretically execute
arbitrary code with root privileges or cause database corruption. This
bug can only be triggered in configurations that allow large numbers of
open file descriptors in a process.

The GSSAPI vulnerabilities could be exploited by a remote attacker to
cause Denial of Service conditions or possibly execute arbitrary code.

Workaround
==========

Kerberos 4 support can be disabled via disabling the "krb4" USE flag
and recompiling the ebuild, or setting "v4_mode=none" in the
[kdcdefaults] section of /etc/krb5/kdc.conf. This will only work around
the KDC related vulnerabilities.

Resolution
==========

All MIT Kerberos 5 users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.6.3-r1"

References
==========

[ 1 ] CVE-2007-5901
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5894
[ 2 ] CVE-2007-5971
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5971
[ 3 ] CVE-2008-0062
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0062
[ 4 ] CVE-2008-0063
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0063
[ 5 ] CVE-2008-0947
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0947

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200803-31.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2008 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    15 Files
  • 20
    Jul 20th
    15 Files
  • 21
    Jul 21st
    15 Files
  • 22
    Jul 22nd
    7 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close