June 2007

ID: 144
Ref: 89/2007
Date: 30 June 2007:23:20:07
Version: 1

---

Title: Technical Cyber Security Alert TA07-177A: MIT Kerberos Vulnerabilities
Abstract: The MIT Kerberos 5 implementation contains several vulnerabilities. Exploitation of these vulnerabilities could allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service on a vulnerable system.
Vendors affected: MIT
Operating systems affected: MIT

---

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

National Cyber Alert System

Technical Cyber Security Alert TA07-177A


MIT Kerberos Vulnerabilities

Original release date: June 26, 2007
Last revised: --
Source: US-CERT


Systems Affected

* MIT Kerberos

Other products that use the RPC library provided with MIT Kerberos or
other RPC libraries derived from SunRPC may also be affected.


Overview

The MIT Kerberos 5 implementation contains several vulnerabilities.
Exploitation of these vulnerabilities could allow a remote,
unauthenticated attacker to execute arbitrary code or cause a denial
of service on a vulnerable system.


I. Description

There are three vulnerabilities that affect MIT Kerberos 5:

* VU#356961 - MIT Kerberos RPC library gssrpc__svcauth_gssapi()
uninitialized pointer free vulnerability

A vulnerability in the MIT Kerberos administration daemon
(kadmind) may allow an uninitialized pointer to be freed, which
may allow a remote, unauthenticated user to execute arbitrary
code. This vulnerability can be triggered by sending a specially
crafted Kerberos message to a vulnerable system.


* VU#365313 - MIT Kerberos kadmind RPC library
gssrpc__svcauth_unix() integer conversion error

An integer conversion error vulnerability exists in the MIT
Kerberos kadmind that may allow a remote, unauthenticated user to
execute arbitrary code.


* VU#554257 - MIT Kerberos kadmind principal renaming stack buffer
overflow

A stack buffer overflow exists in the way the MIT Kerberos kadmind
handles the principle renaming operation, which may allow a
remote, authenticated user to execute arbitrary code.


II. Impact

A remote, unauthenticated attacker may be able to execute arbitrary
code on KDCs, systems running kadmind, and application servers that
use the RPC library. An attacker could also cause a denial of service
on any of these systems. These vulnerabilities could result in the
compromise of both the KDC and an entire Kerberos realm.


III. Solution

Check with your vendors for patches or updates. For information about
a vendor, please see the systems affected section in the individual
vulnerability notes or contact your vendor directly.
Alternatively, apply the appropriate source code patches referenced in
MITKRB5-SA-2007-004 and MITKRB5-SA-2007-005 and recompile.
These vulnerabilities will also be addressed in the krb5-1.6.2 and
krb5-1.5.4 releases.


IV. References

* US-CERT Vulnerability Note VU#365313 -
<http://www.kb.cert.org/vuls/id/365313>

* US-CERT Vulnerability Note VU#356961 -
<http://www.kb.cert.org/vuls/id/356961>

* US-CERT Vulnerability Note VU#554257 -
<http://www.kb.cert.org/vuls/id/554257>

* MIT krb5 Security Advisory 2007-004 -
<http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-004.txt>

* MIT krb5 Security Advisory 2007-005 -
<http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-005.txt>



____________________________________________________________________

The most recent version of this document can be found at:

<http://www.us-cert.gov/cas/techalerts/TA07-177A.html>
____________________________________________________________________

Feedback can be directed to US-CERT Technical Staff. Please send
email to <cert@cert.org> with "TA07-177A Feedback VU#554257" in the
subject.
____________________________________________________________________

For instructions on subscribing to or unsubscribing from this
mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
____________________________________________________________________

Produced 2007 by US-CERT, a government organization.

Terms of use:

<http://www.us-cert.gov/legal.html>
____________________________________________________________________

Revision History

June 26, 2007: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRoF2qexOF3G+ig+rAQJGTgf/TDX6H7Ra80yTOPn4gbIxEt2rXv7zOErl
jRbQpYXkyM2cS17PEcA6om+/VpgiwTYQ3+R25gjDO9TBozOSh5gXZLPJiLIG56e/
5unlug85vAK2atpdpXp2PlJeTtPg7R4T4IayNPJYoVMS25l697EA0AYjsiW6wBLy
M8rvsl+TyZoBIbZn06xhVsnZduE+HTKKJX4ZWGSlJjIj6iHIF1zNkvju1J9jSDqq
7QZBaarD3lXCSfukCpeLUEm7T8+9gUXDu+DMSR07NnXpKzQKCHR8fsqT1r9PPXfE
zJntAWrmC4xtx3XA+H0/Kjb9JK6L4G/CogNiReEmMkceDjAP4xbpWw==
=ALEE
-----END PGP SIGNATURE-----

__________________________________________________________________________

CPNI values your feedback.

1. Which of the following most reflects the value of the advisory to you?
(Place an 'X' next to your choice)

Very useful:__ Useful:__ Not useful:__

2. If you did not find it useful, why not?


3. Any other comments? How could we improve our advisories?


Thank you for your contribution.
___________________________________________________________________________

CPNI wishes to acknowledge the contributions of US-CERT for the
information contained in this advisory.
___________________________________________________________________________

This advisory contains information released by the original author. Some
of the information may have changed since it was released. If the issue
affects you, it may be prudent to retrieve the advisory from the site of
the original source to ensure that you receive the most current
information concerning that problem.

Reference to any specific commercial product, process, or service by trade
name, trademark manufacturer, or otherwise, does not constitute or imply
its endorsement, recommendation, or favouring by CPNI. The views and
opinions of authors expressed within this notice shall not be used for
advertising or product endorsement purposes.

CPNI shall not accept responsibility for any errors or omissions contained
within this advisory. In particular, they shall not be liable for any loss
or damage whatsoever, arising from or in connection with the usage of
information contained within this advisory.

CPNI is a member of the Forum of Incident Response and Security Teams
(FIRST) and has contacts with other international Incident Response Teams
(IRTs) in order to foster cooperation and coordination in incident
prevention, to prompt rapid reaction to incidents, and to promote
information sharing amongst its members and the community at large.
___________________________________________________________________________