ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script.

An updated rhev-hypervisor5 package that fixes several security issues and various bugs is now available.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The rhev-hypervisor5 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

A heap overflow flaw was found in the way QEMU-KVM emulated the e1000 network interface card. A privileged guest user in a virtual machine whose network interface is configured to use the e1000 emulated driver could use this flaw to crash the host or, possibly, escalate their privileges on the host. (CVE-2012-0029)

A divide-by-zero flaw was found in the Linux kernel's igmp_heard_query() function. An attacker able to send certain IGMP (Internet Group Management Protocol) packets to a target system could use this flaw to cause a denial of service. (CVE-2012-0207)

A double free flaw was discovered in the policy checking code in OpenSSL. A remote attacker could use this flaw to crash an application that uses OpenSSL by providing an X.509 certificate that has specially crafted policy extension data. (CVE-2011-4109)

An information leak flaw was found in the SSL 3.0 protocol implementation in OpenSSL. Incorrect initialization of SSL record padding bytes could cause an SSL client or server to send a limited amount of possibly sensitive data to its SSL peer via the encrypted connection. (CVE-2011-4576)

It was discovered that OpenSSL did not limit the number of TLS/SSL handshake restarts required to support Server Gated Cryptography. A remote attacker could use this flaw to make a TLS/SSL server using OpenSSL consume an excessive amount of CPU by continuously restarting the handshake. (CVE-2011-4619)

Red Hat would like to thank Nicolae Mogoreanu for reporting CVE-2012-0029, and Simon McVittie for reporting CVE-2012-0207.

This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers :

CVE-2006-1168 and CVE-2011-2716 (busybox issues)

CVE-2009-5029, CVE-2009-5064, CVE-2010-0830 and CVE-2011-1089 (glibc issues)

CVE-2011-1083, CVE-2011-3638, CVE-2011-4086, CVE-2011-4127 and CVE-2012-0028 (kernel issues)

CVE-2011-1526 (krb5 issue)

CVE-2011-4347 (kvm issue)

CVE-2010-4008, CVE-2011-0216, CVE-2011-2834, CVE-2011-3905, CVE-2011-3919 and CVE-2011-1944 (libxml2 issues)

CVE-2011-1749 (nfs-utils issue)

CVE-2011-4108 (openssl issue)

CVE-2011-0010 (sudo issue)

CVE-2011-1675 and CVE-2011-1677 (util-linux issues)

CVE-2010-0424 (vixie-cron issue)

This updated rhev-hypervisor5 package fixes various bugs.
Documentation of these changes will be available shortly in the Technical Notes document :

https://docs.redhat.com/docs/en-US/ Red_Hat_Enterprise_Virtualization_for_Servers/2.2/html/Technical_Notes / index.html

Users of Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which fixes these issues.

This update of krb5 applications fixes two security issues.

CVE-2011-4862: A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.)

CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems.

The following issues have been fixed :

  - CVE-2011-1528: In releases krb5-1.8 and later, the KDC     can crash due to an assertion failure.

  - CVE-2011-1529: In releases krb5-1.8 and later, the KDC     can crash due to a NULL pointer dereference.

Both bugs could be triggered by unauthenticated remote attackers.
Additionally CVE-2011-1526 was fixed that allowed authenticated users to access files via krb5 ftpd they should not have access to.

The following issues have been fixed :

  - CVE-2011-1528: In releases krb5-1.8 and later, the KDC     can crash due to an assertion failure. 

  - CVE-2011-1529: In releases krb5-1.8 and later, the KDC     can crash due to a NULL pointer dereference. 

Both bugs could be triggered by unauthenticated remote attackers.
Additionally CVE-2011-1526 was fixed that allowed authenticated users to access files via krb5 ftpd they should not have access to.

From Red Hat Security Advisory 2012:0306 :

Updated krb5 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).

It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Red Hat Enterprise Linux 5, the ftpd daemon did not check for the potential failure of the effective group ID change system call. If the group ID change failed, a remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group. (CVE-2011-1526)

Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Tim Zingelman as the original reporter.

This update also fixes the following bugs :

* Due to a mistake in the Kerberos libraries, a client could fail to contact a Key Distribution Center (KDC) or terminate unexpectedly if the client had already more than 1024 file descriptors in use. This update backports modifications to the Kerberos libraries and the libraries use the poll() function instead of the select() function, as poll() does not have this limitation. (BZ#701444)

* The KDC failed to release memory when processing a TGS (ticket-granting server) request from a client if the client request included an authenticator with a subkey. As a result, the KDC consumed an excessive amount of memory. With this update, the code releasing the memory has been added and the problem no longer occurs.
(BZ#708516)

* Under certain circumstances, if services requiring Kerberos authentication sent two authentication requests to the authenticating server, the second authentication request was flagged as a replay attack. As a result, the second authentication attempt was denied.
This update applies an upstream patch that fixes this bug. (BZ#713500)

* Previously, if Kerberos credentials had expired, the klist command could terminate unexpectedly with a segmentation fault when invoked with the -s option. This happened when klist encountered and failed to process an entry with no realm name while scanning the credential cache. With this update, the underlying code has been modified and the command handles such entries correctly. (BZ#729067)

* Due to a regression, multi-line FTP macros terminated prematurely with a segmentation fault. This occurred because the previously-added patch failed to properly support multi-line macros. This update restores the support for multi-line macros and the problem no longer occurs. (BZ#735363, BZ#736132)

All users of krb5 are advised to upgrade to these updated packages, which resolve these issues.

From Red Hat Security Advisory 2011:0920 :

Updated krb5-appl packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The krb5-appl packages provide Kerberos-aware telnet, ftp, rcp, rsh, and rlogin clients and servers. While these have been replaced by tools such as OpenSSH in most environments, they remain in use in others.

It was found that gssftp, a Kerberos-aware FTP server, did not properly drop privileges. A remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group. (CVE-2011-1526)

Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Tim Zingelman as the original reporter.

All krb5-appl users should upgrade to these updated packages, which contain a backported patch to correct this issue.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

It was found that ftpd, a Kerberos-aware FTP server, did not properly drop privileges. On Scientific Linux 5, the ftpd daemon did not check for the potential failure of the effective group ID change system call. If the group ID change failed, a remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group. (CVE-2011-1526)

This update also fixes the following bugs :

  - Due to a mistake in the Kerberos libraries, a client     could fail to contact a Key Distribution Center (KDC) or     terminate unexpectedly if the client had already more     than 1024 file descriptors in use. This update backports     modifications to the Kerberos libraries and the     libraries use the poll() function instead of the     select() function, as poll() does not have this     limitation.

  - The KDC failed to release memory when processing a TGS     (ticket-granting server) request from a client if the     client request included an authenticator with a subkey.
    As a result, the KDC consumed an excessive amount of     memory. With this update, the code releasing the memory     has been added and the problem no longer occurs.

  - Under certain circumstances, if services requiring     Kerberos authentication sent two authentication requests     to the authenticating server, the second authentication     request was flagged as a replay attack. As a result, the     second authentication attempt was denied. This update     applies an upstream patch that fixes this bug.

  - Previously, if Kerberos credentials had expired, the     klist command could terminate unexpectedly with a     segmentation fault when invoked with the -s option. This     happened when klist encountered and failed to process an     entry with no realm name while scanning the credential     cache. With this update, the underlying code has been     modified and the command handles such entries correctly.

  - Due to a regression, multi-line FTP macros terminated     prematurely with a segmentation fault. This occurred     because the previously-added patch failed to properly     support multi-line macros. This update restores the     support for multi-line macros and the problem no longer     occurs.

All users of krb5 are advised to upgrade to these updated packages, which resolve these issues.

The krb5-appl packages provide Kerberos-aware telnet, ftp, rcp, rsh, and rlogin clients and servers. While these have been replaced by tools such as OpenSSH in most environments, they remain in use in others.

It was found that gssftp, a Kerberos-aware FTP server, did not properly drop privileges. A remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group. (CVE-2011-1526)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2012:0306 advisory.

  - krb5, krb5-appl: ftpd incorrect group privilege dropping (MITKRB5-SA-2011-005) (CVE-2011-1526)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201201-14 (MIT Kerberos 5 Applications: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5       Applications:
      An error in the FTP daemon prevents it from dropping its initial         effective group identifier (CVE-2011-1526).
      A boundary error in the telnet daemon and client could cause a buffer         overflow (CVE-2011-4862).
  Impact :

    An unauthenticated remote attacker may be able to execute arbitrary code       with the privileges of the user running the telnet daemon or client.
      Furthermore, an authenticated remote attacker may be able to read or       write files owned by the same group as the effective group of the FTP       daemon.
  Workaround :

    There is no known workaround at this time.

This update of krb5 fixes two security issues.

  - A remote code execution in the kerberized telnet daemon     was fixed. (This only affects the ktelnetd from the     krb5-appl RPM, not the regular telnetd supplied by     SUSE.). (CVE-2011-4862)

  - / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file     access problems. (CVE-2011-1526)

Tim Zingelmann discovered that due an incorrect configure script the kerborised FTP server failed to set the effective GID correctly, resulting in privilege escalation.

The oldstable distribution (lenny) is not affected.

A vulnerability was discovered and corrected in krb5-appl :

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid return value, which allows remote authenticated users to bypass intended group access restrictions, and create, overwrite, delete, or read files, via standard FTP commands, related to missing autoconf tests in a configure script (CVE-2011-1526).

The updated packages have been patched to correct this issue.

This update corrects a potential failure to properly set the effective group ID in the GSSAPI-capable FTP server (MITKRB5-SA-2011-005, CVE-2011-1526).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated krb5-appl packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The krb5-appl packages provide Kerberos-aware telnet, ftp, rcp, rsh, and rlogin clients and servers. While these have been replaced by tools such as OpenSSH in most environments, they remain in use in others.

It was found that gssftp, a Kerberos-aware FTP server, did not properly drop privileges. A remote FTP user could use this flaw to gain unauthorized read or write access to files that are owned by the root group. (CVE-2011-1526)

Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Tim Zingelman as the original reporter.

All krb5-appl users should upgrade to these updated packages, which contain a backported patch to correct this issue.

ID	Name	Product	Family	Severity
79283	RHEL 5 : rhev-hypervisor5 (RHSA-2012:0168)	Nessus	Red Hat Local Security Checks	high
75886	openSUSE Security Update : krb5-appl (openSUSE-SU-2012:0019-1)	Nessus	SuSE Local Security Checks	critical
75885	openSUSE Security Update : krb5 (openSUSE-SU-2011:1169-1)	Nessus	SuSE Local Security Checks	high
75564	openSUSE Security Update : krb5-appl (openSUSE-SU-2012:0019-1)	Nessus	SuSE Local Security Checks	critical
75563	openSUSE Security Update : krb5 (openSUSE-SU-2011:1169-1)	Nessus	SuSE Local Security Checks	high
68477	Oracle Linux 5 : krb5 (ELSA-2012-0306)	Nessus	Oracle Linux Local Security Checks	medium
68302	Oracle Linux 6 : krb5-appl (ELSA-2011-0920)	Nessus	Oracle Linux Local Security Checks	medium
61266	Scientific Linux Security Update : krb5 on SL5.x i386/x86_64 (20120221)	Nessus	Scientific Linux Local Security Checks	medium
61079	Scientific Linux Security Update : krb5-appl on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58060	RHEL 5 : krb5 (RHSA-2012:0306)	Nessus	Red Hat Local Security Checks	medium
57656	GLSA-201201-14 : MIT Kerberos 5 Applications: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
57431	SuSE 10 Security Update : Kerberos 5 (ZYPP Patch Number 7899)	Nessus	SuSE Local Security Checks	critical
57430	SuSE 11.1 Security Update : Kerberos 5 (SAT Patch Number 5594)	Nessus	SuSE Local Security Checks	critical
55673	Debian DSA-2283-1 : krb5-appl - programming error	Nessus	Debian Local Security Checks	medium
55665	Mandriva Linux Security Advisory : krb5-appl (MDVSA-2011:117)	Nessus	Mandriva Local Security Checks	medium
55596	Fedora 14 : krb5-appl-1.0.1-4.fc14 (2011-9109)	Nessus	Fedora Local Security Checks	medium
55595	Fedora 15 : krb5-appl-1.0.1-7.fc15 (2011-9080)	Nessus	Fedora Local Security Checks	medium
55520	RHEL 6 : krb5-appl (RHSA-2011:0920)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2011-1526

medium

Tenable Plugins

high

critical

high

critical

high

medium

medium

medium

medium

medium

critical

critical

critical

medium

medium

medium

medium

medium