(HP Issues Fix for HP-UX) Kerberos krb5_recvauth() Double-Free Error May Let Remote Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1016911 |
|
SecurityTracker URL: http://securitytracker.com/id/1016911
|
|
CVE Reference:
CVE-2005-1689
(Links to External Site)
|
Date: Sep 22 2006
|
Impact:
Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): krb5-1.4.1 and prior versions
|
Description:
A double-free memory vulnerability was reported in Kerberos in the krb5_recvauth() function. A remote user may be able to execute arbitrary code.
A remote user can create certain error conditions to cause the krb5_recvauth() function to free memory that has been previously freed. Arbitrary code may be executed.
If the target system is a Kerberos Key Distribution Center (KDC) host, then the entire Kerberos realm may be compromised.
The 'kpropd', 'klogind', and 'krshd' applications are affected.
The vulnerability resides in 'krb/recvauth.c'.
The vendor credits Magnus Hagander with reporting this vulnerability.
|
Impact:
A remote user may be able to execute arbitrary code.
|
Solution:
HP has issued the following patches, available at:
http://itrc.hp.com
HP-UX B.11.11 - PHSS_33384
HP-UX B.11.23 - PHSS_33389
For B.11.00, download the product update from:
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=J5849AA
The HP advisory is available at:
http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00768776
|
Vendor URL: web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-003-recvauth.txt (Links to External Site)
|
Cause:
State error
|
Underlying OS:
UNIX (HP/UX)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Fri, 22 Sep 2006 09:39:38 -0400
Subject: HPSBUX02152 SSRT5973 rev.1 - HP-UX Kerberos Client Remote Unauthenticated Execution of Arbitrary Code
|
http://www2.itrc.hp.com/service/cki/docDisplay.do?docId=c00768776
CVE-2005-1689
|
|
