aru Posted April 3, 2003 Report Share Posted April 3, 2003 MandrakeSoft Security Advisory MDKSA-2003:043-1 : krb5 April 3rd, 2003 Updated krb5 packages fix multiple vulnerabilities Multiple vulnerabilties have been found in the Kerberos network authentication system. The MIT Kerberos team have released an advisory detailing these vulnerabilties, a description of which follows. An integer signedness error in the ASN.1 decoder before version 1.2.5 allows remote attackers to cause a crash of the server via a large unsigned data element length, which is later used as a negative value (CAN-2002-0036). Mandrake Linux 9.0+ is not affected by this problem. Vulnerabilties have been found in the RPC library used by the kadmin service. A faulty length check in the RPC library exposes kadmind to an integer overflow which can be used to crash kadmind (CAN-2003-0028). The KDC (Key Distribution Center) before version 1.2.5 allows remote, authenticated attackers to cause a crash on KDCs within the same realm using a certain protocol that causes a null dereference (CAN-2003-0058). Mandrake Linux 9.0+ is not affected by this problem. Users from one realm can impersonate users in other realms that have the same inter-realm keys due to a vulnerability in Kerberos 1.2.3 and earlier (CAN-2003-0059). Mandrake Linux 9.0+ is not affected by this problem. The KDC allows remote, authenticated users to cause a crash on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (CAN-2003-0072). The KDC allows remote, authenticated users to cause a crash on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (CAN-2003-0082). Vulnerabilities have been discovered in the Kerberos IV authentication protocol which allow an attacker with knowledge of a cross-realm key, which is shared in another realm, to impersonate a principle in that realm to any service in that realm. This vulnerability can only be closed by disabling cross-realm authentication in Kerberos IV (CAN-2003-0138). Vulnerabilities have been discovered in the support for triple-DES keys in the Kerberos IV authentication protocol which is included in MIT Kerberos (CAN-2003-0139). MandrakeSoft encourages all users to upgrade to these updated packages immediately which contain patches to correct all of the previously noted vulnerabilities. These packages also disable Kerberos IV cross-realm authentication by default. Update: The packages for Mandrake Linux 9.1 and 9.1/PPC were not GPG-signed.This has been fixed and as a result the md5sums have changed. Thanks to Mark Lyda for pointing this out. The released versions of Mandrake GNU/Linux affected are: 9.1 [*] 9.1/PPC Full information about this advisory, including the updated packages, is available at: www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2003:043-1 Other references: http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2002-0036 http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0028 http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0058 http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0059 http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0072 http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0082 http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0138 http://cve.mitre.org/cgi-bin/cvename.cgi?n...e=CAN-2003-0139 http://web.mit.edu/kerberos/www/advisories...01-multiple.txt http://web.mit.edu/kerberos/www/advisories...003-003-xdr.txt http://web.mit.edu/kerberos/www/advisories...03-004-krb4.txt http://web.mit.edu/kerberos/www/advisories...003-005-buf.txt Posted automatically by aru (mdksec2mub v0.0.5) Link to comment Share on other sites More sharing options...
Recommended Posts