(HP Issues Fix for HP-UX) Kerberos kadmin 'gss_buffer_t' May Be Freed Twice Allowing Remote Authenticated Users to Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018097 |
|
SecurityTracker URL: http://securitytracker.com/id/1018097
|
|
CVE Reference:
CVE-2007-1216
(Links to External Site)
|
Date: May 22 2007
|
Impact:
Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): Kerberos Client software version 1.3.5.05 and prior
|
Description:
A vulnerability was reported in Kerberos in the administration daemon. A remote authenticated user can execute arbitrary code on the target system.
The krb5 GSS-API kg_unseal_v1() function may free the gss_buffer_t buffer that an application may later free again (via the gss_release_buffer() function) under certain error conditions. As a result, arbitrary code may be executed. The Kerberos key database can be compromised.
The vulnerability resides in the GSS-API library. As a result, some third-party applications may be affected.
This vulnerability was discovered using the SAP AG GSSTEST test program.
|
Impact:
A remote authenticated user can execute arbitrary code on the target system.
|
Solution:
HP has issued the following fixes.
B.11.11:
PHSS_36286 or Kerberos Client C.1.3.5.06 or subsequent
B.11.23:
PHSS_34991 or Kerberos Client D.1.3.5.06 or subsequent
B.11.31:
PHSS_36361 or subsequent
The software updates are available at:
http://www.hp.com/go/softwaredepot/
The patches are available at:
http://itrc.hp.com
|
Vendor URL: web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-003.txt (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
UNIX (HP/UX)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 22 May 2007 13:24:29 -0400
Subject: HPSBUX02217 SSRT071337 rev.1 - HP-UX running Kerberos, Remote Arbitrary Code Execution
|
https://www1.itrc.hp.com/service/cki/docDisplay.do?docId=c01056923
CVE-2007-1216
|
|
