(Fedora Issues Fix for FC2) Kerberos Buffer Overflows in krb5_aname_to_localname() May Let Remote Users Gain Root Access
|
|
SecurityTracker Alert ID: 1010457 |
|
SecurityTracker URL: http://securitytracker.com/id/1010457
|
|
CVE Reference:
CAN-2004-0523
(Links to External Site)
|
Date: Jun 10 2004
|
Impact:
Execution of arbitrary code via network, Root access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 5-1.3.3 and prior versions
|
Description:
Some buffer overflow vulnerabilities were reported in Kerberos 5 in the krb5_aname_to_localname() function. A remote user may be able to gain root access on the target system.
MIT reported that there are several overflows in the krb5_aname_to_localname() library function. According to the report, an "unusual combination" of factors are required to successfully exploit the flaw, including authenticating to a vulnerable service using a principal name explicitly listed in the mapping list.
The report also indicates that default configurations of the target service are not affected. Only those configurations that enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname() are reported to be vulnerable.
If the rules-based mapping functionality is enabled, the remote user must first create an arbitrary principal name in the local Kerberos realm or in a remote realm that is accessible via cross-realm authentication.
It is reported that various remote login services (e.g., ftp, rsh, rlogin, telnet) are affected, as well as ksu. Other services that use the krb5 library may be affected if they use the vulnerable function, the report said.
|
Impact:
In certain cases, a remote user may be able to execute arbitrary code with root privileges.
|
Solution:
Fedora has released a fix, available at:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
437540335f79da1cbbc18d164e6215c0 SRPMS/krb5-1.3.3-7.src.rpm
cd6c377ee71fc3ac7a2ed1451632bc99 i386/krb5-devel-1.3.3-7.i386.rpm
4a4a06a0dd0bddb0bf9aefc35825029c i386/krb5-libs-1.3.3-7.i386.rpm
f857845fde8315c8d6416e5d7befc605 i386/krb5-server-1.3.3-7.i386.rpm
84cc98e232f3834450b450d44dd9374a i386/krb5-workstation-1.3.3-7.i386.rpm
1ee42664e020e7fa5a4a1c8202aabdee i386/debug/krb5-debuginfo-1.3.3-7.i386.rpm
6dbdb3334974c1735a044deb2632e3a6 x86_64/krb5-devel-1.3.3-7.x86_64.rpm
864422b001ad11e0468ed53cbe6276fe x86_64/krb5-libs-1.3.3-7.x86_64.rpm
606c96ce4814f686a99d7231aa5a6080 x86_64/krb5-server-1.3.3-7.x86_64.rpm
ad1573302d8702c705608d5f2803362d x86_64/krb5-workstation-1.3.3-7.x86_64.rpm
6409ec2efcf54640e58451b32efb270a x86_64/debug/krb5-debuginfo-1.3.3-7.x86_64.rpm
4a4a06a0dd0bddb0bf9aefc35825029c x86_64/krb5-libs-1.3.3-7.i386.rpm
|
Vendor URL: web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-001-an_to_ln.txt (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
Linux (Red Hat Fedora)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 4 Jun 2004 15:08:50 -0400
Subject: [SECURITY] Fedora Core 2 Update: krb5-1.3.3-7
|
--===============0365476249==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="Fba/0zbH8Xs+Fj9o"
Content-Disposition: inline
--Fba/0zbH8Xs+Fj9o
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-150
2004-06-04
---------------------------------------------------------------------
Product : Fedora Core 2
Name : krb5
Version : 1.3.3 =20
Release : 7 =20
Summary : The Kerberos network authentication system.
Description :
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords.
---------------------------------------------------------------------
Update Information:
Bugs have been fixed in the krb5_aname_to_localname library function.
Specifically, buffer overflows were possible for all Kerberos
versions up to and including 1.3.3. The krb5_aname_to_localname
function translates a Kerberos principal name to a local account
name, typically a UNIX username. This function is frequently used
when performing authorization checks.
If configured with mappings from particular Kerberos principals to
particular UNIX user names, certain functions called by
krb5_aname_to_localname will not properly check the lengths of
buffers used to store portions of the principal name. If configured
to map principals to user names using rules, krb5_aname_to_localname
would consistently write one byte past the end of a buffer allocated
from the heap. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0523 to this issue.
Only configurations which enable the explicit mapping or rules-based
mapping functionality of krb5_aname_to_localname() are vulnerable.
These configurations are not the default.
---------------------------------------------------------------------
* Fri Jun 04 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-7
- rebuild
* Fri Jun 04 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-6
- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)
* Tue Jun 01 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-5
- rebuild
* Tue Jun 01 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-4
- apply patch from MITKRB5-SA-2004-001 (#125001)
* Wed May 12 2004 Thomas Woerner <twoerner@redhat.com> 1.3.3-3
- removed rpath
* Thu Apr 15 2004 Nalin Dahyabhai <nalin@redhat.com> 1.3.3-2
- re-enable large file support, fell out in 1.3-1
- patch rcp to use long long and %lld format specifiers when reporting file
sizes on large files
---------------------------------------------------------------------
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
437540335f79da1cbbc18d164e6215c0 SRPMS/krb5-1.3.3-7.src.rpm
cd6c377ee71fc3ac7a2ed1451632bc99 i386/krb5-devel-1.3.3-7.i386.rpm
4a4a06a0dd0bddb0bf9aefc35825029c i386/krb5-libs-1.3.3-7.i386.rpm
f857845fde8315c8d6416e5d7befc605 i386/krb5-server-1.3.3-7.i386.rpm
84cc98e232f3834450b450d44dd9374a i386/krb5-workstation-1.3.3-7.i386.rpm
1ee42664e020e7fa5a4a1c8202aabdee i386/debug/krb5-debuginfo-1.3.3-7.i386.rpm
6dbdb3334974c1735a044deb2632e3a6 x86_64/krb5-devel-1.3.3-7.x86_64.rpm
864422b001ad11e0468ed53cbe6276fe x86_64/krb5-libs-1.3.3-7.x86_64.rpm
606c96ce4814f686a99d7231aa5a6080 x86_64/krb5-server-1.3.3-7.x86_64.rpm
ad1573302d8702c705608d5f2803362d x86_64/krb5-workstation-1.3.3-7.x86_64.rpm
6409ec2efcf54640e58451b32efb270a x86_64/debug/krb5-debuginfo-1.3.3-7.x86_6=
4.rpm
4a4a06a0dd0bddb0bf9aefc35825029c x86_64/krb5-libs-1.3.3-7.i386.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command. =20
---------------------------------------------------------------------
--Fba/0zbH8Xs+Fj9o
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFAwMi9N5vOV3hoi/URAiUhAKDoUZLiXljWZdmWygpqA8eczgZTYgCfdGks
huD7NNlOv4uJIT7Zw+GFwak=
=RulP
-----END PGP SIGNATURE-----
--Fba/0zbH8Xs+Fj9o--
--===============0365476249==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
--
fedora-announce-list mailing list
fedora-announce-list@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list
--===============0365476249==--
|
|
