Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - Fix for (CVE-2011-4862)

  - incorporate a fix to teach the file labeling bits about     when replay caches are expunged (#712453)

  - rebuild

  - ftp: handle larger command inputs (#665833)

  - don't bail halfway through an unlock operation when the     result will be discarded and the end-result not cleaned     up (Martin Osvald, #586032)

  - add a versioned dependency between krb5-server-ldap and     krb5-libs (internal tooling)

  - don't discard the error code from an error message     received in response to a change-password request     (#658871, RT#6893)

  - ftpd: add patch from Jatin Nansi to correctly match     restrict lines in /etc/ftpusers (#644215, RT#6889)

  - ftp: add modified patch from Rogan Kyuseok Lee to report     the number of bytes transferred correctly when     transferring large files on 32-bit systems (#648404)

  - backport fix for RT#6514: memory leak freeing rcache     type none (#678205)

  - add upstream patch to fix hang or crash in the KDC when     using the LDAP kdb backend (CVE-2011-0281,     CVE-2011-0282, #671097)

  - incorporate upstream patch for checksum acceptance     issues from MITKRB5-SA-2010-007 (CVE-2010-1323, #652308)

  - backport a fix to the previous change (#539423)

  - backport the k5login_directory and k5login_authoritative     settings (#539423)

  - krshd: don't limit user names to 16 chars when utmp can     handle names at least a bit longer than that (#611713)

  - fix a logic bug in computing key expiration times     (RT#6762, #627038)

  - correct the post-rotate scriptlet in the kadmind     logrotate config (more of #462658)

  - ftpd: backport changes to modify behavior to match     telnetd,rshd,rlogind and accept GSSAPI auth to any     service for which we have a matching key (#538075)

  - pull in fix for RT#5551 to treat the referral realm when     seen in a ticket as though it were the local realm     (#498554, also very likely #450122)

  - add aes256-cts:normal and aes128-cts:normal to the list     of keysalts in the default kdc.conf (part of #565941)

  - add a note to kdc.conf(5) pointing to the admin guide     for the list of recognized key and salt types (the rest     of #565941)

  - add logrotate configuration files for krb5kdc and     kadmind (#462658)

  - libgssapi: backport patch from svn to stop returning     context-expired errors when the ticket which was used to     set up the context expires (#605367, upstream #6739)

  - enable building the -server-ldap subpackage (#514362)

  - stop caring about the endianness of stash files     (#514741), which will be replaced by proper keytab files     in later releases

  - don't crash in krb5_get_init_creds_password if the     passed-in options struct is NULL and the clients keys     have expired (#555875)

  - ksu: perform PAM account and session management before     dropping privileges to those of the target user (#540769     and #596887, respectively)

  - add candidate patch to correct libgssapi null pointer     dereference which could be triggered by malformed client     requests (CVE-2010-1321, #583704)

  - fix a null pointer dereference and crash introduced in     our PAM patch that would happen if ftpd was given the     name of a user who wasnt known to the local system,     limited to being triggerable by gssapi-authenticated     clients by the default xinetd config (Olivier Fourdan,     #569472)

  - add upstream patch to fix a few use-after-free bugs,     including one in kadmind (CVE-2010-0629, #578186)

  - merge patch to correct KDC integer overflows which could     be triggered by malformed RC4 and AES ciphertexts     (CVE-2009-4212, #546348)

  - pull changes to libkrb5 to properly handle and chase     off-path referrals back from 1.7 (#546538)

  - add an auth stack to ksus PAM configuration so that it     can successfully pam_setcred

  - also set PAM_RUSER in ksu for completeness     (#479071+#477033)

  - fix various typos, except for bits pertaining to     licensing (#499190)

  - kdb5_util: when renaming a database, if the new names     associated lock files don't exist, go ahead and create     them (#442879)

  - ksu: perform PAM account and session management for the     target user  authentication is still performed as before     (#477033)

  - fix typo in ksus reporting of errors getting credentials     (#462890)

  - kadmind.init: stop setting up a keytab, as kadminds been     able to use the database directly for a while now     (#473151)

  - pull up patch to set PAM_RHOST (James Leddy, #479071)

From Red Hat Security Advisory 2010:0343 :

Updated krb5 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

A use-after-free flaw was discovered in the MIT Kerberos administration daemon, kadmind. A remote, authenticated attacker could use this flaw to crash the kadmind daemon. Administrative privileges are not required to trigger this flaw, as any realm user can request information about their own principal from kadmind. (CVE-2010-0629)

This update also fixes the following bug :

* when a Kerberos client seeks tickets for use with a service, it must contact the Key Distribution Center (KDC) to obtain them. The client must also determine which realm the service belongs to and it typically does this with a combination of client configuration detail, DNS information and guesswork.

If the service belongs to a realm other than the client's, cross-realm authentication is required. Using a combination of client configuration and guesswork, the client determines the trust relationship sequence which forms the trusted path between the client's realm and the service's realm. This may include one or more intermediate realms.

Anticipating the KDC has better knowledge of extant trust relationships, the client then requests a ticket from the service's KDC, indicating it will accept guidance from the service's KDC by setting a special flag in the request. A KDC which recognizes the flag can, at its option, return a ticket-granting ticket for the next realm along the trust path the client should be following.

If the ticket-granting ticket returned by the service's KDC is for use with a realm the client has already determined was in the trusted path, the client accepts this as an optimization and continues. If, however, the ticket is for use in a realm the client is not expecting, the client responds incorrectly: it treats the case as an error rather than continuing along the path suggested by the service's KDC.

For this update, the krb5 1.7 modifications which allow the client to trust such KDCs to send them along the correct path, resulting in the client obtaining the tickets it originally desired, were backported to krb 1.6.1 (the version shipped with Red Hat Enterprise Linux 5.5).
(BZ#578540)

All krb5 users should upgrade to these updated packages, which contain backported patches to correct these issues. All running KDC services must be restarted for the update to take effect.

Sol Jerome discovered that the Kerberos kadmind service did not correctly free memory. An unauthenticated remote attacker could send specially crafted traffic to crash the kadmind process, leading to a denial of service. (CVE-2010-0629)

It was discovered that Kerberos did not correctly free memory in the GSSAPI library. If a remote attacker were able to manipulate an application using GSSAPI carefully, the service could crash, leading to a denial of service. (Ubuntu 8.10 was not affected.) (CVE-2007-5901, CVE-2007-5971)

It was discovered that Kerberos did not correctly free memory in the GSSAPI and kdb libraries. If a remote attacker were able to manipulate an application using these libraries carefully, the service could crash, leading to a denial of service. (Only Ubuntu 8.04 LTS was affected.) (CVE-2007-5902, CVE-2007-5972).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A use-after-free flaw was discovered in the MIT Kerberos administration daemon, kadmind. A remote, authenticated attacker could use this flaw to crash the kadmind daemon. Administrative privileges are not required to trigger this flaw, as any realm user can request information about their own principal from kadmind. (CVE-2010-0629)

This update also fixes the following bug :

  - when a Kerberos client seeks tickets for use with a     service, it must contact the Key Distribution Center     (KDC) to obtain them. The client must also determine     which realm the service belongs to and it typically does     this with a combination of client configuration detail,     DNS information and guesswork.

If the service belongs to a realm other than the client's, cross-realm authentication is required. Using a combination of client configuration and guesswork, the client determines the trust relationship sequence which forms the trusted path between the client's realm and the service's realm. This may include one or more intermediate realms.

Anticipating the KDC has better knowledge of extant trust relationships, the client then requests a ticket from the service's KDC, indicating it will accept guidance from the service's KDC by setting a special flag in the request. A KDC which recognizes the flag can, at its option, return a ticket-granting ticket for the next realm along the trust path the client should be following.

If the ticket-granting ticket returned by the service's KDC is for use with a realm the client has already determined was in the trusted path, the client accepts this as an optimization and continues. If, however, the ticket is for use in a realm the client is not expecting, the client responds incorrectly: it treats the case as an error rather than continuing along the path suggested by the service's KDC.

For this update, the krb5 1.7 modifications which allow the client to trust such KDCs to send them along the correct path, resulting in the client obtaining the tickets it originally desired, were backported to krb 1.6.1 (the version shipped with Scientific Linux 5.5). (BZ#578540)

All running KDC services must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201201-13 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the administration daemon or the Key Distribution Center       (KDC) daemon, cause a Denial of Service condition, or possibly obtain       sensitive information. Furthermore, a remote attacker may be able to       spoof Kerberos authorization, modify KDC responses, forge user data       messages, forge tokens, forge signatures, impersonate a client, modify       user-visible prompt text, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Authenticated users could crash the kadmind process by referencing freed memory (CVE-2010-0629). This has been fixed.

Sol Jerome noticed that the kadmind server daemon could be made to dereference freed memory and crash. This update backports the changeset which contains the fix for this bug (CVE-2010-0629).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated krb5 packages that fix one security issue and one bug are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

A use-after-free flaw was discovered in the MIT Kerberos administration daemon, kadmind. A remote, authenticated attacker could use this flaw to crash the kadmind daemon. Administrative privileges are not required to trigger this flaw, as any realm user can request information about their own principal from kadmind. (CVE-2010-0629)

This update also fixes the following bug :

* when a Kerberos client seeks tickets for use with a service, it must contact the Key Distribution Center (KDC) to obtain them. The client must also determine which realm the service belongs to and it typically does this with a combination of client configuration detail, DNS information and guesswork.

If the service belongs to a realm other than the client's, cross-realm authentication is required. Using a combination of client configuration and guesswork, the client determines the trust relationship sequence which forms the trusted path between the client's realm and the service's realm. This may include one or more intermediate realms.

Anticipating the KDC has better knowledge of extant trust relationships, the client then requests a ticket from the service's KDC, indicating it will accept guidance from the service's KDC by setting a special flag in the request. A KDC which recognizes the flag can, at its option, return a ticket-granting ticket for the next realm along the trust path the client should be following.

If the ticket-granting ticket returned by the service's KDC is for use with a realm the client has already determined was in the trusted path, the client accepts this as an optimization and continues. If, however, the ticket is for use in a realm the client is not expecting, the client responds incorrectly: it treats the case as an error rather than continuing along the path suggested by the service's KDC.

For this update, the krb5 1.7 modifications which allow the client to trust such KDCs to send them along the correct path, resulting in the client obtaining the tickets it originally desired, were backported to krb 1.6.1 (the version shipped with Red Hat Enterprise Linux 5.5).
(BZ#578540)

All krb5 users should upgrade to these updated packages, which contain backported patches to correct these issues. All running KDC services must be restarted for the update to take effect.

An authenticated remote attacker can causing a denial of service by using a newer version of the kadmin protocol than the server supports.

The MIT Kerberos team also reports the cause :

The Kerberos administration daemon (kadmind) can crash due to referencing freed memory.

Multiple vulnerabilities has been found and corrected in mozilla-thunderbird :

Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing (CVE-2009-0689).

Integer overflow in a base64 decoding function in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors (CVE-2009-2463).

Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3072).

Multiple unspecified vulnerabilities in the JavaScript engine in Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.2, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors (CVE-2009-3075).

Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, does not properly manage pointers for the columns (aka TreeColumns) of a XUL tree element, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to a dangling pointer vulnerability. (CVE-2009-3077)

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file (CVE-2009-3376).

Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user (CVE-2009-3983).

Mozilla Thunderbird before 2.0.0.24 and SeaMonkey before 1.1.19 process e-mail attachments with a parser that performs casts and line termination incorrectly, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted message, related to message indexing (CVE-2010-0163).

This update provides the latest version of Thunderbird which are not vulnerable to these issues.

Packages for 2008.0 and 2009.0 are provided due to the Extended Maintenance Program for those products.

Additionally, some packages which require so, have been rebuilt and are being provided as updates.

Authenticated users could crash the kadmind process by referencing freed memory (CVE-2010-0629).

Sol Jerome discovered that kadmind service in krb5, a system for authenticating users and services on a network, allows remote authenticated users to cause a denial of service (daemon crash) via a request from a kadmin client that sends an invalid API version number.

ID	Name	Product	Family	Severity
79475	OracleVM 2.2 : krb5 (OVMSA-2011-0015)	Nessus	OracleVM Local Security Checks	low
68029	Oracle Linux 5 : krb5 (ELSA-2010-0343)	Nessus	Oracle Linux Local Security Checks	medium
65123	Ubuntu 8.04 LTS / 8.10 / 9.04 : krb5 vulnerabilities (USN-924-1)	Nessus	Ubuntu Local Security Checks	critical
60779	Scientific Linux Security Update : krb5 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57655	GLSA-201201-13 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
50926	SuSE 11 Security Update : krb5 (SAT Patch Number 2235)	Nessus	SuSE Local Security Checks	medium
47416	Fedora 11 : krb5-1.6.3-29.fc11 (2010-6108)	Nessus	Fedora Local Security Checks	medium
46754	CentOS 5 : krb5 (CESA-2010:0343)	Nessus	CentOS Local Security Checks	medium
46296	RHEL 5 : krb5 (RHSA-2010:0343)	Nessus	Red Hat Local Security Checks	medium
45573	FreeBSD : krb5 -- remote denial of service vulnerability (a30573dc-4893-11df-a5f9-001641aeabdf)	Nessus	FreeBSD Local Security Checks	medium
45521	Mandriva Linux Security Advisory : mozilla-thunderbird (MDVSA-2010:071)	Nessus	Mandriva Local Security Checks	critical
45493	openSUSE Security Update : krb5 (openSUSE-SU-2010:0099-1)	Nessus	SuSE Local Security Checks	medium
45491	openSUSE Security Update : krb5 (openSUSE-SU-2010:0099-1)	Nessus	SuSE Local Security Checks	medium
45479	Debian DSA-2031-1 : krb5 - use-after-free	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-0629

medium

Tenable Plugins

low

medium

critical

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium