(Red Hat Issues Fix for RHEL) Kerberos 5 KDC Double-Free Errors May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1011113
|
|
SecurityTracker URL: http://securitytracker.com/id?1011113
|
|
CVE Reference: CAN-2004-0642
, CAN-2004-0643
(Links to External Site)
|
Date: Aug 31 2004
|
Impact: Execution of arbitrary code via network, User access via network
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 1.2.2-31
|
Description: Several double-free vulnerabilities were reported in the Kerberos 5 Key Distribution Center (KDC) software. A remote user may be able to execute arbitrary code and compromise the Kerberos domain.
The vendor reported that the ASN.1 decoder functions use inconsistent memory management conventions. Under certain error conditions,
the ASN.1 decoders may free memory without nulling the corresponding pointers [CVE: CAN-2004-0642]. As a result, some library functions
that receive errors from from the ASN.1 decoders may attempt to free the non-null pointers.
It is also reported that krb5_rd_cred()
in versions prior to 1.3.2 frees already-freed buffers returned by the decode_krb5_enc_cred_part() function when an error is returned
[CVE: CAN-2004-0643].
It is also reported that a patch introduced in version 1.2.8 to disable krb4 cross-realm authentication
in krb524d contains a double-free vulnerability [CVE: CAN-2004-0772].
The vendor credits Will Fiveash and Nico Williams at Sun,
Marc Horowitz, Nalin Dahyabhai, Joseph Galbraith, and John Hawkinson with discovering these flaws.
|
Impact: A remote user may be able to execute arbitrary code on a target KDC system. This will compromise the entire Kerberos realm.
A
reomte user may be able to execute arbitrary code on a target system running krb524d.
A remote user acting as a KDC or application
server may be able to execute arbitrary code on a target client host while the client is authenticating.
|
Solution: Red Hat has released a fix.
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/krb5-1.2.2-31.sr
c.rpm
908bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
i386:
f5fc294848750e1186efd792aaca3fa1 krb5-devel-1.2.2-31.i386.rpm
1da2499c2aa50026be1eda1774cb8fc0
krb5-libs-1.2.2-31.i386.rpm
72749007a7033ff2a31dc4ee20a439c7 krb5-server-1.2.2-31.i386.rpm
be44496d6d25c3e5c1754ce871b3de49
krb5-workstation-1.2.2-31.i386.rpm
ia64:
d81f70e064675a486c9a796fd1ea6297 krb5-devel-1.2.2-31.ia64.rpm
bd5eeae1a8d4b97585bbe67b746edb1d
krb5-libs-1.2.2-31.ia64.rpm
bb30a6820d6c475452458a3cebca55b8 krb5-server-1.2.2-31.ia64.rpm
c7b3177d7e82f890ef669196c2ff0f8f
krb5-workstation-1.2.2-31.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/krb5-1.2.2-31.src.rpm
908
bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
ia64:
d81f70e064675a486c9a796fd1ea6297 krb5-devel-1.2.2-31.ia64.rpm
bd5eeae1a8d4b97585bbe67b746edb1d
krb5-libs-1.2.2-31.ia64.rpm
bb30a6820d6c475452458a3cebca55b8 krb5-server-1.2.2-31.ia64.rpm
c7b3177d7e82f890ef669196c2ff0f8f
krb5-workstation-1.2.2-31.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/krb5-1.2.2-31.src.rpm
90
8bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
i386:
f5fc294848750e1186efd792aaca3fa1 krb5-devel-1.2.2-31.i386.rpm
1da2499c2aa50026be1eda1774cb8fc0
krb5-libs-1.2.2-31.i386.rpm
72749007a7033ff2a31dc4ee20a439c7 krb5-server-1.2.2-31.i386.rpm
be44496d6d25c3e5c1754ce871b3de49
krb5-workstation-1.2.2-31.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/krb5-1.2.2-31.src.rpm
90
8bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
i386:
f5fc294848750e1186efd792aaca3fa1 krb5-devel-1.2.2-31.i386.rpm
1da2499c2aa50026be1eda1774cb8fc0
krb5-libs-1.2.2-31.i386.rpm
72749007a7033ff2a31dc4ee20a439c7 krb5-server-1.2.2-31.i386.rpm
be44496d6d25c3e5c1754ce871b3de49
krb5-workstation-1.2.2-31.i386.rpm
Red Hat reports that the krb524 server vulnerability [CVE: CAN-2004-0772] was corrected by
a previous erratum [RHSA-2003:052].
|
Vendor URL: web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt (Links to External Site)
|
Cause: State error
|
Underlying OS: Linux (Red Hat Enterprise)
|
Underlying OS Comments: 2.1
|
Reported By: bugzilla@redhat.com
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 31 Aug 2004 13:35 -0400
From: bugzilla@redhat.com
Subject: [RHSA-2004:448-01] Updated krb5 packages fix security
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated krb5 packages fix security vulnerabilities
Advisory ID: RHSA-2004:448-01
Issue date: 2004-08-31
Updated on: 2004-08-31
Product: Red Hat Enterprise Linux
Keywords: krb5 double-free asn.1
Obsoletes: RHSA-2004:236
CVE Names: CAN-2004-0642 CAN-2004-0643 CAN-2004-0644
- ---------------------------------------------------------------------
1. Summary:
Updated Kerberos (krb5) packages that correct double-free and ASN.1
parsing bugs are now available for Red Hat Enterprise Linux.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
3. Problem description:
Kerberos is a networked authentication system that uses a trusted third
party (a KDC) to authenticate clients and servers to each other.
Several double-free bugs were found in the Kerberos 5 KDC and libraries. A
remote attacker could potentially exploit these flaws to execute arbitrary
code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2004-0642 and CAN-2004-0643 to these issues.
A double-free bug was also found in the krb524 server (CAN-2004-0772),
however this issue was fixed for Red Hat Enterprise Linux 2.1 users by a
previous erratum, RHSA-2003:052.
An infinite loop bug was found in the Kerberos 5 ASN.1 decoder library. A
remote attacker may be able to trigger this flaw and cause a denial of
service. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0644 to this issue.
All users of krb5 should upgrade to these updated packages, which contain
backported security patches to resolve these issues.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):
129680 - Upgrading to krb5-libs 1.2.2-27 can cause undefined symbol __dn_expand
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/krb5-1.2.2-31.src.rpm
908bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
i386:
f5fc294848750e1186efd792aaca3fa1 krb5-devel-1.2.2-31.i386.rpm
1da2499c2aa50026be1eda1774cb8fc0 krb5-libs-1.2.2-31.i386.rpm
72749007a7033ff2a31dc4ee20a439c7 krb5-server-1.2.2-31.i386.rpm
be44496d6d25c3e5c1754ce871b3de49 krb5-workstation-1.2.2-31.i386.rpm
ia64:
d81f70e064675a486c9a796fd1ea6297 krb5-devel-1.2.2-31.ia64.rpm
bd5eeae1a8d4b97585bbe67b746edb1d krb5-libs-1.2.2-31.ia64.rpm
bb30a6820d6c475452458a3cebca55b8 krb5-server-1.2.2-31.ia64.rpm
c7b3177d7e82f890ef669196c2ff0f8f krb5-workstation-1.2.2-31.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/krb5-1.2.2-31.src.rpm
908bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
ia64:
d81f70e064675a486c9a796fd1ea6297 krb5-devel-1.2.2-31.ia64.rpm
bd5eeae1a8d4b97585bbe67b746edb1d krb5-libs-1.2.2-31.ia64.rpm
bb30a6820d6c475452458a3cebca55b8 krb5-server-1.2.2-31.ia64.rpm
c7b3177d7e82f890ef669196c2ff0f8f krb5-workstation-1.2.2-31.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/krb5-1.2.2-31.src.rpm
908bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
i386:
f5fc294848750e1186efd792aaca3fa1 krb5-devel-1.2.2-31.i386.rpm
1da2499c2aa50026be1eda1774cb8fc0 krb5-libs-1.2.2-31.i386.rpm
72749007a7033ff2a31dc4ee20a439c7 krb5-server-1.2.2-31.i386.rpm
be44496d6d25c3e5c1754ce871b3de49 krb5-workstation-1.2.2-31.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/krb5-1.2.2-31.src.rpm
908bd9ee7963203d5c086e25b0849568 krb5-1.2.2-31.src.rpm
i386:
f5fc294848750e1186efd792aaca3fa1 krb5-devel-1.2.2-31.i386.rpm
1da2499c2aa50026be1eda1774cb8fc0 krb5-libs-1.2.2-31.i386.rpm
72749007a7033ff2a31dc4ee20a439c7 krb5-server-1.2.2-31.i386.rpm
be44496d6d25c3e5c1754ce871b3de49 krb5-workstation-1.2.2-31.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key.html#package
7. References:
http://web.mit.edu/kerberos/advisories/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0642
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0644
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact.html
Copyright 2004 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQFBNLa8XlSAg2UNWIIRAg9CAJ9SK1zvvZ/iZufrqTpFE/bldet96gCeI9ID
mrh2+P7CT/bdeFXfO5kk8xU=
=6QY7
-----END PGP SIGNATURE-----
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
