(Sun Issues Fix) Kerberos kadmin/KDC Stack Overflow in krb5_klog_syslog() Lets Remote Authenticated Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1018135 |
|
SecurityTracker URL: http://securitytracker.com/id/1018135
|
|
CVE Reference:
CVE-2007-0957
(Links to External Site)
|
Updated: Aug 13 2007
|
Original Entry Date: May 29 2007
|
Impact:
Execution of arbitrary code via network, Root access via network, User access via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): krb5 prior to krb5-1.6.1
|
Description:
A vulnerability was reported in Kerberos in the administration daemon and the KDC. A remote authenticated user can execute arbitrary code on the target system.
A remote authenticated user can send specially crafted data to trigger a stack overflow in the krb5_klog_syslog() function and execute arbitrary code on the target system. The code will run with the privileges of the target service, which typically runs with root privileges. This can compromise the Kerberos key database.
The vulnerability resides in the kadm5 library. As a result, third party applications that use the library may be affected.
The vendor credits iDefense with reporting this vulnerability.
|
Impact:
A remote authenticated user can execute arbitrary code on the target system, typically with root level privileges.
|
Solution:
Sun has issued the following fixes.
SPARC Platform
* SEAM 1.0.1 (for Solaris 8) with patch 110060-22 or later
* Solaris 8 with patch 109223-10 or later
* Solaris 9 with patches 112921-09, 112923-04 and 112925-07 or later (for all patches)
* Solaris 10 with patch 120473-10 or later
x86 Platform
* SEAM 1.0.1 (for Solaris 8) with patch 110061-22 or later
* Solaris 8 with patch 109224-10 or later
* Solaris 9 with patches 116044-04, 116045-02, 116046-09 and 116175-05 or later (for all patches)
* Solaris 10 with patch 120037-20 or later
The vendor notes that when SEAM 1.0.1 is run on a Solaris 8 system, both the SEAM 1.0.1 and Solaris 8 patches listed above should be installed to resolve this issue.
The Sun advisory is available at:
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102930-1
|
Vendor URL: web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-002-syslog.txt (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
UNIX (Solaris - SunOS)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Tue, 29 May 2007 15:22:29 -0400
Subject: Security Vulnerability in the Kerberos kadm5 Library May Allow Execution of Arbitrary Code
|
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102930-1
CVE-2007-0957
|
|
