The kadm5_modify_policy_internal function in lib/kadm5/srv/svr_policy.c in the Kerberos administration daemon (kadmind) in MIT Kerberos 5 (krb5) 1.5 through 1.6.2 does not properly check return values when the policy does not exist, which might allow remote authenticated users with the "modify policy" privilege to execute arbitrary code via unspecified vectors that trigger a write to an uninitialized pointer.

From Red Hat Security Advisory 2007:0858 :

Updated krb5 packages that fix two security flaws are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC. kadmind is the KADM5 administration server.

Tenable Network Security discovered a stack-based buffer overflow flaw in the RPC library used by kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. On Red Hat Enterprise Linux 5 it is not possible to exploit this flaw to run arbitrary code as the overflow is blocked by FORTIFY_SOURCE. (CVE-2007-3999)

Garrett Wollman discovered an uninitialized pointer flaw in kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. (CVE-2007-4000)

These issues did not affect the versions of Kerberos distributed with Red Hat Enterprise Linux 2.1, 3, or 4.

Users of krb5-server are advised to update to these erratum packages which contain backported fixes to correct these issues.

Tenable Network Security discovered a stack-based buffer overflow flaw in the RPC library used by kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. On Red Hat Enterprise Linux 5 it is not possible to exploit this flaw to run arbitrary code as the overflow is blocked by FORTIFY_SOURCE. (CVE-2007-3999)

Garrett Wollman discovered an uninitialized pointer flaw in kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. (CVE-2007-4000)

Updated krb5 packages that fix two security flaws are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC. kadmind is the KADM5 administration server.

Tenable Network Security discovered a stack-based buffer overflow flaw in the RPC library used by kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. On Red Hat Enterprise Linux 5 it is not possible to exploit this flaw to run arbitrary code as the overflow is blocked by FORTIFY_SOURCE. (CVE-2007-3999)

Garrett Wollman discovered an uninitialized pointer flaw in kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. (CVE-2007-4000)

These issues did not affect the versions of Kerberos distributed with Red Hat Enterprise Linux 2.1, 3, or 4.

Users of krb5-server are advised to update to these erratum packages which contain backported fixes to correct these issues.

This update of krb5 fixes two bugs in kadmind that can be used to execute arbitrary code remotely. (CVE-2007-3999 / CVE-2007-4000)

It was discovered that the libraries handling RPCSEC_GSS did not correctly validate the size of certain packet structures. An unauthenticated remote user could send a specially crafted request and execute arbitrary code with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update incorporates fixes for a stack overflow in the rpcsec_gss implementation in libgssrpc (CVE-2007-3999) and a potential write through an uninitialized pointer in kadmind (CVE-2007-4000).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of krb5 fixes two bugs in kadmind that can be used to execute arbitrary code remotely. (CVE-2007-3999, CVE-2007-4000)

The remote host is affected by the vulnerability described in GLSA-200709-01 (MIT Kerberos 5: Multiple vulnerabilities)

    A stack-based buffer overflow (CVE-2007-3999) has been reported in     svcauth_gss_validate() of the RPC library of kadmind. Another     vulnerability (CVE-2007-4000) has been found in     kadm5_modify_policy_internal(), which does not check the return values     of krb5_db_get_policy() correctly.
  Impact :

    The RPC related vulnerability can be exploited by a remote     unauthenticated attacker to execute arbitrary code with root privileges     on the host running kadmind. The second vulnerability requires the     remote attacker to be authenticated and to have 'modify policy'     privileges. It could then also allow for the remote execution of     arbitrary code.
  Workaround :

    There is no known workaround at this time.

A stack-based buffer overflow vulnerability was discovered in the RPC library used by Kerberos' kadmind program by Tenable Network Security.
A remote unauthenticated user who could access kadmind would be able to trigger the flaw and cause it to crash (CVE-2007-3999). This issue is only applicable to Kerberos 1.4 and higher.

Garrett Wollman found an uninitialized pointer vulnerability in kadmind which a remote unauthenticated attacker able to access kadmind could exploit to cause kadmind to crash (CVE-2007-4000). This issue is only applicable to Kerberos 1.5 and higher.

Update :

The MIT Kerberos Team found a problem with the originally published patch for CVE-2007-3999. A remote unauthenticated attacker able to access kadmind could trigger this flaw and cause kadmind to crash.

Updated packages have been patched to prevent these issues.

ID	Name	Product	Family	Severity
67562	Oracle Linux 5 : krb5 (ELSA-2007-0858)	Nessus	Oracle Linux Local Security Checks	critical
60248	Scientific Linux Security Update : krb5 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43650	CentOS 5 : krb5 (CESA-2007:0858)	Nessus	CentOS Local Security Checks	critical
29494	SuSE 10 Security Update : Kerberos (ZYPP Patch Number 4192)	Nessus	SuSE Local Security Checks	critical
28115	Ubuntu 6.06 LTS / 6.10 / 7.04 : krb5, librpcsecgss vulnerability (USN-511-1)	Nessus	Ubuntu Local Security Checks	critical
27744	Fedora 7 : krb5-1.6.1-3.fc7 (2007-2017)	Nessus	Fedora Local Security Checks	critical
27310	openSUSE 10 Security Update : krb5 (krb5-4191)	Nessus	SuSE Local Security Checks	critical
26041	GLSA-200709-01 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
26006	Mandrake Linux Security Advisory : krb5 (MDKSA-2007:174-1)	Nessus	Mandriva Local Security Checks	critical
25987	RHEL 5 : krb5 (RHSA-2007:0858)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2007-4000

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical