Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.

SEAM 1.0 Jumbo patch for Solaris 2.7_x86.
Date this patch was last updated by Sun : Oct/03/05

SEAM 1.0 Jumbo patch for Solaris 2.7.
Date this patch was last updated by Sun : Oct/03/05

In their advisory MITKRB5-SA-2004-001, the MIT Kerberos announced the existence of buffer overflow vulnerabilities in the krb5_aname_to_localname function. This function is only used if aname_to_localname is enabled in the configuration (this is not enabled by default).

The remote host is missing Apple's Security Update 2004-09-07. This security update fixes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump

The remote host is missing Security Update 2004-09-07.  This security update fixes the following components :

  - CoreFoundation
  - IPSec
  - Kerberos
  - libpcap
  - lukemftpd
  - NetworkConfig
  - OpenLDAP
  - OpenSSH
  - PPPDialer
  - rsync
  - Safari
  - tcpdump

These applications contain multiple vulnerabilities that may allow a remote attacker to execute arbitrary code.

The remote host is affected by the vulnerability described in GLSA-200406-21 (mit-krb5: Multiple buffer overflows in krb5_aname_to_localname)

    The library function krb5_aname_to_localname() contains multiple buffer     overflows. This is only exploitable if explicit mapping or rules-based     mapping is enabled. These are not enabled as default.
    With explicit mapping enabled, an attacker must authenticate using a     principal name listed in the explicit mapping list.
    With rules-based mapping enabled, an attacker must first be able to create     arbitrary principal names either in the local realm Kerberos realm or in a     remote realm from which the local realm's service are reachable by     cross-realm authentication.
  Impact :

    An attacker could use these vulnerabilities to execute arbitrary code with     the permissions of the user running mit-krb5, which could be the root user.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version.

Multiple buffer overflows exist in the krb5_aname_to_localname() library function that if exploited could lead to unauthorized root privileges. In order to exploit this flaw, an attacker must first successfully authenticate to a vulnerable service, which must be configured to enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname, which is not a default configuration.

Mandrakesoft encourages all users to upgrade to these patched krb5 packages.

Update :

The original patch provided contained a bug where rule-based entries on systems without HAVE_REGCOMP would not work. These updated packages provide the second patch provided by Kerberos development team which fixes that behaviour.

Bugs have been fixed in the krb5_aname_to_localname library function.
Specifically, buffer overflows were possible for all Kerberos versions up to and including 1.3.3. The krb5_aname_to_localname function translates a Kerberos principal name to a local account name, typically a UNIX username. This function is frequently used when performing authorization checks.

If configured with mappings from particular Kerberos principals to particular UNIX user names, certain functions called by krb5_aname_to_localname will not properly check the lengths of buffers used to store portions of the principal name. If configured to map principals to user names using rules, krb5_aname_to_localname would consistently write one byte past the end of a buffer allocated from the heap. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0523 to this issue.

Only configurations which enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname() are vulnerable.
These configurations are not the default.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SunOS 5.9_x86: krb5, gss patch.
Date this patch was last updated by Sun : Sep/14/10

SunOS 5.9: krb5, gss patch.
Date this patch was last updated by Sun : Sep/14/10

Updated Kerberos 5 (krb5) packages which correct buffer overflows in the krb5_aname_to_localname function are now available.

Kerberos is a network authentication system.

Bugs have been fixed in the krb5_aname_to_localname library function.
Specifically, buffer overflows were possible for all Kerberos versions up to and including 1.3.3. The krb5_aname_to_localname function translates a Kerberos principal name to a local account name, typically a UNIX username. This function is frequently used when performing authorization checks.

If configured with mappings from particular Kerberos principals to particular UNIX user names, certain functions called by krb5_aname_to_localname will not properly check the lengths of buffers used to store portions of the principal name. If configured to map principals to user names using rules, krb5_aname_to_localname would consistently write one byte past the end of a buffer allocated from the heap. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0523 to this issue.

Only configurations which enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname() are vulnerable.
These configurations are not the default.

Users of Kerberos are advised to upgrade to these erratum packages which contain backported security patches to correct these issues.

ID	Name	Product	Family	Severity
23294	Solaris 7 (x86) : 112537-06	Nessus	Solaris Local Security Checks	critical
23248	Solaris 7 (sparc) : 112536-06	Nessus	Solaris Local Security Checks	critical
15357	Debian DSA-520-1 : krb5 - buffer overflows	Nessus	Debian Local Security Checks	critical
2274	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus Network Monitor	Web Clients	medium
14676	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus	MacOS X Local Security Checks	high
14532	GLSA-200406-21 : mit-krb5: Multiple buffer overflows in krb5_aname_to_localname	Nessus	Gentoo Local Security Checks	critical
14155	Mandrake Linux Security Advisory : krb5 (MDKSA-2004:056-1)	Nessus	Mandriva Local Security Checks	critical
13711	Fedora Core 2 : krb5-1.3.3-7 (2004-150)	Nessus	Fedora Local Security Checks	critical
13710	Fedora Core 1 : krb5-1.3.3-6 (2004-149)	Nessus	Fedora Local Security Checks	critical
13620	Solaris 9 (x86) : 115168-24	Nessus	Solaris Local Security Checks	critical
13520	Solaris 9 (sparc) : 112908-38	Nessus	Solaris Local Security Checks	critical
12502	RHEL 2.1 / 3 : krb5 (RHSA-2004:236)	Nessus	Red Hat Local Security Checks	critical
800802	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2004-0523

critical

Tenable Plugins

critical

critical

critical

medium

high

critical

critical

critical

critical

critical

critical

critical

high