From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pigeon.gentoo.org ([69.77.167.62] helo=lists.gentoo.org) by finch.gentoo.org with esmtp (Exim 4.60) (envelope-from ) id 1JdsXs-0001cu-JJ for garchives@archives.gentoo.org; Mon, 24 Mar 2008 19:41:24 +0000 Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E0A26E04E0; Mon, 24 Mar 2008 19:41:23 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) by pigeon.gentoo.org (Postfix) with ESMTP id 9884EE04E0 for ; Mon, 24 Mar 2008 19:41:23 +0000 (UTC) Received: from stork.gentoo.org (stork.gentoo.org [64.127.104.133]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTP id 212706683D for ; Mon, 24 Mar 2008 19:41:23 +0000 (UTC) Received: from rbu by stork.gentoo.org with local (Exim 4.68) (envelope-from ) id 1JdsXp-0007FC-UF for gentoo-commits@lists.gentoo.org; Mon, 24 Mar 2008 19:41:21 +0000 From: "Robert Buchholz (rbu)" To: gentoo-commits@lists.gentoo.org Reply-To: gentoo-dev@lists.gentoo.org, rbu@gentoo.org Subject: [gentoo-commits] gentoo commit in xml/htdocs/security/en/glsa: glsa-200803-31.xml X-VCS-Repository: gentoo X-VCS-Files: glsa-200803-31.xml X-VCS-Directories: xml/htdocs/security/en/glsa X-VCS-Committer: rbu X-VCS-Committer-Name: Robert Buchholz Content-Type: text/plain; charset=utf8 Message-Id: Sender: Robert Buchholz Date: Mon, 24 Mar 2008 19:41:21 +0000 Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: quoted-printable X-Archives-Salt: bd62d42e-6eeb-432d-b038-4501257016af X-Archives-Hash: 2856cd379530d856606e753668f45111 rbu 08/03/24 19:41:21 Added: glsa-200803-31.xml Log: GLSA 200803-31 Revision Changes Path 1.1 xml/htdocs/security/en/glsa/glsa-200803-31.xml file : http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/security/en= /glsa/glsa-200803-31.xml?rev=3D1.1&view=3Dmarkup plain: http://sources.gentoo.org/viewcvs.py/gentoo/xml/htdocs/security/en= /glsa/glsa-200803-31.xml?rev=3D1.1&content-type=3Dtext/plain Index: glsa-200803-31.xml =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D MIT Kerberos 5: Multiple vulnerabilities Multiple vulnerabilites have been found in MIT Kerberos 5, which coul= d allow a remote unauthenticated user to execute arbitrary code with ro= ot privileges. mit-krb5 March 24, 2008 March 24, 2008: 01 199205 212363 remote 1.6.3-r1 1.6.3-r1

MIT Kerberos 5 is a suite of applications that implement the Kerberos network protocol. kadmind is the MIT Kerberos 5 administration daemon= , KDC is the Key Distribution Center.

  • Two vulnerabilities were found in the Kerberos 4 support in KDC: A global variable is not set for some incoming message types, leading to a NULL pointer dereference or a double free() (CVE-2008-0062) and unused portions of a buffer are not properly cleared when generating an error message, which results in stack content being contained in a reply (CVE-2008-0063).
  • Jeff Altman (Secure Endpoints) discovered a buffer overflow in the RPC library server code, used in the kadmin server, caused when too many file descriptors are opened (CVE-2008-0947).
  • Venustech AD-LAB discovered multiple vulnerabilities in the GSSAPI library: usage of a freed variable in the gss_indicate_mechs() function (CVE-2007-5901) a= nd a double free() vulnerability in the gss_krb5int_make_seal_token_v3() function (CVE-2007-5971).

The first two vulnerabilities can be exploited by a remote unauthenticated attacker to execute arbitrary code on the host runnin= g krb5kdc, compromise the Kerberos key database or cause a Denial of Service. These bugs can only be triggered when Kerberos 4 support is enabled.

The RPC related vulnerability can be exploited by a remote unauthenticated attacker to crash kadmind, and theoretically execute arbitrary code with root privileges or cause database corruption. Thi= s bug can only be triggered in configurations that allow large numbers = of open file descriptors in a process.

The GSSAPI vulnerabilities could be exploited by a remote attacker to cause Denial of Service conditions or possibly execute arbitrary code= .

Kerberos 4 support can be disabled via disabling the "krb4" USE flag and recompiling the ebuild, or setting "v4_mode=3Dnone" in the [kdcdefaults] section of /etc/krb5/kdc.conf. This will only work arou= nd the KDC related vulnerabilities.

All MIT Kerberos 5 users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=3Dapp-crypt/mit-krb5-1.= 6.3-r1" CVE-2007-5901 CVE-2007-5971 CVE-2008-0062 CVE-2008-0063 CVE-2008-0947 p-y rbu