Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


More on LinuxToday


Conectiva Linux Advisory: krb5

May 05, 2003, 20:27 (0 Talkback[s])


- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : krb5
SUMMARY   : Several Kerberos vulnerabilities
DATE      : 2003-05-05 16:23:00
ID        : CLA-2003:639
RELEVANT
RELEASES  : 8

- -------------------------------------------------------------------------

DESCRIPTION
 The "krb5" packages are MIT's[1] implementation of the Kerberos 5
 authentication protocol.
 
 This update fixes the vulnerabilities outlined below:
 
 1. Principal name handling vulnerabilities[2] (CAN-2003-0082[3] and
 CAN-2003-0072[4])
 Nalin Dahyabhai discovered buffer overrun and underrun problems in
 the code that handles Kerberos principal names. When presented with
 some unusual names, such as names with zero components, names with
 one empty component, or host-based service principal names with no
 host name component, at least a program crash would result.
 
 2. Cryptographic weaknesses in Kerberos v4 protocol[5]
 (CAN-2003-0138[6] and CAN-2003-0139[7])
 A weakness in the Kerberos v4 protocol allows an attacker to
 impersonate any principal in a realm. If done against cross-realm
 principals, such an attack could lead to the compromise of other
 realms which share a cross-realm key with the local realm. This
 update disabled Kerberos 4 cross-realm authentication by default.
 Additionally, MIT's implementation of the Kerberos 4 protocol
 included in the krb5 package allow an attacker to fabricate krb4
 tickets if 3DES keys are used.
 
 3. Faulty length checks in xdrmem_getbytes[8] (CAN-2003-0028[9])
 The xdrmem_*() family of functions (such as xdrmem_getbytes()) from
 the XDR library used by MIT Kerberos contains integer overflows that
 may be exploited by remote (but authenticated) attackers to cause a
 denial of service condition or even expose sensitive information.
 
 4. Multiple vulnerabilities in old releases of MIT Kerberos[10]
 - ASN.1 decoding flaw[11]: the ASN.1 decoder contains integer
 signedness errors which could be used by remote attackers to crash
 the program;
 - KDC null pointer dereference[12]: a remote attacker could make the
 KDC attempt to dereference a NULL pointer, resulting in a program
 crash and a denial of service condition;
 - Inter-realm user impersonation[13] and format string
 vulnerability[14] (cited in MIT's advisory but already fixed in our
 previous 1.2.3 package)
 
 This announcement upgrades the Kerberos packages in Conectiva Linux 8
 to the 1.2.8 version. Please note that Conectiva Linux 9 includes a
 patched 1.2.7 version and is not vulnerable to these issues.


SOLUTION
 It is recommended that all Kerberos users in Conectiva Linux 8
 upgrade their packages. Please note that the service will be
 automatically restarted after the upgrade if it was already running.
 
 Several applications can make use of the Kerberos libraries. It is
 recommended that those applications be restarted as well. A list of
 such applications can be obtained right after the upgrade by running
 the following command:
 
 
 lsof | grep ;
 
 
 REFERENCES
 1.http://web.mit.edu/Kerberos/www/index.html
 2.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt
 3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0082
 4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0072
 5.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-004-krb4.txt
 6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0138
 7.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0139
 8.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-003-xdr.txt
 9.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0028
 10.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt
 11.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0036
 12.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0058
 13.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0059
 14.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0060


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/SRPMS/krb5-1.2.8-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-apps-clients-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-apps-servers-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-client-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-devel-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-devel-static-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-doc-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-server-1.2.8-1U80_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com