Re: SECUNIA warning:[SA16041] Kerberos V5 Multiple Vulnerabilities

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 07/19/05


Date: Mon, 18 Jul 2005 17:43:01 -0700

This is nothing official (as it never could be from myself :) )
just an informed opinion.

The advisory deals with MIT verberos v5 at release 1.4.1 and
earlier. Windows 2000 and later includes an implementation of
the Kerberos v5 specification, done by Microsoft.
It is not MIT Kerberos.

If MS has errors in their implementation it would be quite odd
that they would be in the same places.

-- 
Roger Abell
Microsoft MVP (Windows  Security)
"Patrick" <Patrick@discussions.microsoft.com> wrote in message
news:106BE44F-92A4-4DFD-8A68-9F4F5A99715A@microsoft.com...
> Does anyone know if this affects any of the Windows architectures like
Active
> Directory running on Windows 2000.
>
> See the full SECUNIA warning below:
>
> Subject: [SA16041] Kerberos V5 Multiple Vulnerabilities
>
>
>
> ----------------------------------------------------------------------
>
> Bist Du interessiert an einem neuen Job in IT-Sicherheit?
>
>
> Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
> Sicherheit:
> http://secunia.com/secunia_vacancies/
>
> ----------------------------------------------------------------------
>
> TITLE:
> Kerberos V5 Multiple Vulnerabilities
>
> SECUNIA ADVISORY ID:
> SA16041
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/16041/
>
> CRITICAL:
> Highly critical
>
> IMPACT:
> DoS, System access
>
> WHERE:
> From remote
>
> SOFTWARE:
> Kerberos V5
> http://secunia.com/product/556/
>
> DESCRIPTION:
> Some vulnerabilities have been reported in Kerberos, which can be
> exploited by malicious people to cause a DoS (Denial of Service) or
> potentially compromise a vulnerable system.
>
> 1) A double-free error in the "krb5_recvauth()" function can
> potentially be exploited to execute arbitrary code in the context of
> the program calling this function.
>
> Successful exploitation may lead to the compromise of an entire
> Kerberos realm or cause the program to crash.
>
> The vulnerability has been reported in kpropd, klogind, and krshd
> versions 1.4.1 and prior. Any third-party programs calling the
> "krb5_recvauth()" function are also vulnerable.
>
> 2) An error in the Key Distribution Center (KDC) implementation
> causes the freeing of memory at random locations, which leads to heap
> corruption via a specially crafted TCP request.
>
> Successful exploitation crashes the KDC.
>
> The vulnerability has been reported in KDC implementations versions
> 1.4.1 and prior.
>
> 3) A boundary error in the KDC can cause a single-byte heap-based
> buffer overflow via a specially crafted TCP or UDP request. This can
> potentially be exploited to execute arbitrary code.
>
> Successful exploitation may lead to the compromise of an entire
> Kerberos realm or cause a DoS.
>
> The vulnerability has been reported in KDC implementations and
> application servers versions 1.4.1 and prior. Third-party application
> servers using MIT krb5 are also affected.
>
> SOLUTION:
> Apply patches:
> http://web.mit.edu/kerberos/advisories/2005-003-patch_1.4.1.txt
> http://web.mit.edu/kerberos/advisories/2005-002-patch_1.4.1.txt
>
> The vulnerabilities will also be fixed in version 1.4.2.
>
> PROVIDED AND/OR DISCOVERED BY:
> 1) The vendor credits Magnus Hagander.
> 2, 3) The vendor credits Daniel Wachdorf.
>
> ORIGINAL ADVISORY:
>
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-003-recvauth.txt
> http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-002-kdc.txt
>
> ----------------------------------------------------------------------
>
> About:
> This Advisory was delivered by Secunia as a free service to help
> everybody keeping their systems up to date against the latest
> vulnerabilities.
>
> Subscribe:
> http://secunia.com/secunia_security_advisories/
>
> Definitions: (Criticality, Where etc.)
> http://secunia.com/about_secunia_advisories/
>
>
> Please Note:
> Secunia recommends that you verify all advisories you receive by
> clicking the link.
> Secunia NEVER sends attached files with advisories.
> Secunia does not advise people to install third party patches, only
> use those supplied by the vendor.
>
>
>
>
>


Relevant Pages