---------------------------------------------------------------------- BETA test the new Secunia Personal Software Inspector! The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors. Download the free PSI BETA from the Secunia website: https://psi.secunia.com/ ---------------------------------------------------------------------- TITLE: Kerberos Multiple Vulnerabilities SECUNIA ADVISORY ID: SA26676 VERIFY ADVISORY: http://secunia.com/advisories/26676/ CRITICAL: Highly critical IMPACT: DoS, System access WHERE: >From remote SOFTWARE: Kerberos 5.x http://secunia.com/product/556/ DESCRIPTION: Some vulnerabilities have been reported in Kerberos, which can be exploited by malicious users and malicious people to compromise a vulnerable system. 1) A boundary error within the implementation of the RPCSEC_GSS authentication type exists in the "svcauth_gss_validate()" function in src/lib/rpc/svc_auth_gss.c. This can be exploited to cause a stack-based buffer overflow by sending a specially crafted RPC message to a vulnerable server. Successful exploitation potentially allows the execution of arbitrary code. Products linking to the RPC library may also be affected. 2) The "kadm5_modify_policy_internal()" function in src/lib/kadm5/srv/svr_policy.c does not correctly check return values of the "krb5_db_get_policy()" function. This can be exploited to cause a memory corruption and may potentially allow the execution of arbitrary code. Successful exploitation requires valid user credentials and privileges to modify policies. Vulnerability #1 is reported in krb5-1.4 through krb5-1.6.2, vulnerability #2 is reported in krb5-1.5 through krb5-1.6.2. SOLUTION: Update to Kerberos 1.5.5 or 1.6.3 as soon as available or apply patches. http://web.mit.edu/kerberos/advisories/2007-006-patch.txt PROVIDED AND/OR DISCOVERED BY: 1) The vendor credits Tenable Network Security, reported via the Zero Day Initiative. 2) Garrett Wollman, MIT CSAIL. ORIGINAL ADVISORY: http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-006.txt OTHER REFERENCES: US-CERT VU#883632: http://www.kb.cert.org/vuls/id/883632 US-CERT VU#377544: http://www.kb.cert.org/vuls/id/377544 ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------