-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

        ESB-2004.0805 -- MIT Kerberos 5 Security Advisory 2004-004
                    heap buffer overflow in libkadm5srv
                             21 December 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           MIT Kerberos 5
Operating System:  UNIX variants
                   Linux variants
                   Windows
                   Mac OS
Impact:            Execute Arbitrary Code/Commands
Access:            Existing Account
CVE Names:         CAN-2004-1189

Original Bulletin: 
  http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-004-pwhist.txt

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----

                 MIT krb5 Security Advisory 2004-004

Original release: 2004-12-20

Topic: heap buffer overflow in libkadm5srv

Severity: serious

SUMMARY
=======

The MIT Kerberos 5 administration library (libkadm5srv) contains a
heap buffer overflow in password history handling code which could be
exploited to execute arbitrary code on a Key Distribution Center (KDC)
host.  The overflow occurs during a password change of a principal
with a certain password history state.  An administrator must have
performed a certain password policy change in order to create the
vulnerable state.  (See MITIGATING FACTORS below.)

No exploits are known to exist at this time, though a public
discussion of the bug took place during the first weeks of December
2004, containing sufficient detail that someone could infer how to
perform an attack.  Exploitation of this vulnerability is believed to
be difficult, due to the limited extent of the overflow.

IMPACT
======

An authenticated user, not necessarily one with administrative
privileges, could execute arbitrary code on the KDC host, compromising
an entire Kerberos realm.  [CAN-2004-1189]

MITIGATING FACTORS
==================

* Typically, only a principal satisfying the following conditions can
  trigger the buffer overflow upon password change:

  + have changed its password fewer times than the history count in
    its password policy

  + had its password policy's history count subsequently reduced to
    equal the number of times it has changed its password

* There are other means of producing the vulnerable state, though they
  are significantly more complex and much less likely.  All of these
  other methods involve a reduction of the password history count in a
  password policy.

* A workaround exists (see FIXES).

AFFECTED SOFTWARE
=================

* KDC software on all releases of MIT krb5, up to and including
  krb5-1.3.5.  The vulnerable library is libkadm5srv.  Programs which
  use the vulnerable functionality of the library include:

  + kadmind (administration daemon)

  + kadmin.local (KDC-local administration client)

  + kadmind4 (krb4 compatibility administration daemon)

FIXES
=====

* WORKAROUND: Until your KDC programs and libraries have been patched,
  do not decrease the password history count on any policy in your
  Kerberos realm.  Also, if you have already decreased the password
  history count on a policy at some point in the past, you should
  raise it to the maximum value that it has had in the past.

* The upcoming krb5-1.4 release (currently in beta test) will contain
  fixes for this problem.  The krb5-1.4-beta3 release contains fixes
  for this problem.

* The upcoming krb5-1.3.6 patch release contains fixes for this
  problem.

* Apply the following patch to src/lib/kadm5/srv/svr_principal.c, and
  recompile the affected libraries and binaries.  This patch was
  generated against krb5-1.3.5, and may apply, with some offset, to
  earlier releases.

  This patch may also be found at:

  http://web.mit.edu/kerberos/advisories/2004-004-patch_1.3.5.txt

  The associated detached PGP signature is at:

  http://web.mit.edu/kerberos/advisories/2004-004-patch_1.3.5.txt.asc

Index: svr_principal.c
===================================================================
RCS file: /cvs/krbdev/krb5/src/lib/kadm5/srv/svr_principal.c,v
retrieving revision 1.26.2.1
diff -c -r1.26.2.1 svr_principal.c
*** svr_principal.c	2 Sep 2003 18:58:56 -0000	1.26.2.1
- - --- svr_principal.c	20 Dec 2004 19:47:29 -0000
***************
*** 1017,1022 ****
- - --- 1017,1025 ----
  	  
  	  memset(&adb->old_keys[adb->old_key_len],0,sizeof(osa_pw_hist_ent)); 
       	  adb->old_key_len++;
+ 	  for (i = adb->old_key_len - 1; i > adb->old_key_next; i--)
+ 	      adb->old_keys[i] = adb->old_keys[i - 1];
+ 	  memset(&adb->old_keys[adb->old_key_next],0,sizeof(osa_pw_hist_ent));
       } else if (adb->old_key_len > pol->pw_history_num-1) {
  	 /*
  	  * The policy must have changed!  Shrink the array.
***************
*** 1039,1048 ****
  		 histp[i] = adb->old_keys[j];
  	     }
  	     /* Now free the ones we don't keep (the oldest ones) */
! 	     for (i = 0; i < adb->old_key_len - (pol->pw_history_num - 1); i++)
  		 for (j = 0; j < adb->old_keys[KADM_MOD(i)].n_key_data; j++)
  		     krb5_free_key_data_contents(context,
  				&adb->old_keys[KADM_MOD(i)].key_data[j]);
  	     free((void *)adb->old_keys);
  	     adb->old_keys = histp;
  	     adb->old_key_len = pol->pw_history_num - 1;
- - --- 1042,1053 ----
  		 histp[i] = adb->old_keys[j];
  	     }
  	     /* Now free the ones we don't keep (the oldest ones) */
! 	     for (i = 0; i < adb->old_key_len - (pol->pw_history_num-1); i++) {
  		 for (j = 0; j < adb->old_keys[KADM_MOD(i)].n_key_data; j++)
  		     krb5_free_key_data_contents(context,
  				&adb->old_keys[KADM_MOD(i)].key_data[j]);
+ 		 free(adb->old_keys[KADM_MOD(i)].key_data);
+ 	     }
  	     free((void *)adb->old_keys);
  	     adb->old_keys = histp;
  	     adb->old_key_len = pol->pw_history_num - 1;
***************
*** 1052,1061 ****
- - --- 1057,1070 ----
  	 }
       }
  
+      if (adb->old_key_next + 1 > adb->old_key_len)
+ 	 adb->old_key_next = 0;
+ 
       /* free the old pw history entry if it contains data */
       histp = &adb->old_keys[adb->old_key_next];
       for (i = 0; i < histp->n_key_data; i++)
  	  krb5_free_key_data_contents(context, &histp->key_data[i]);
+      free(histp->key_data);
       
       /* store the new entry */
       adb->old_keys[adb->old_key_next] = *pw;

REFERENCES
==========

This announcement and related security advisories may be found on the
MIT Kerberos security advisory page at:

        http://web.mit.edu/kerberos/advisories/index.html

The main MIT Kerberos web page is at:

        http://web.mit.edu/kerberos/index.html

CERT VU#948033:

        http://www.kb.cert.org/vuls/id/948033

CVE CAN-2004-1189:

        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1189

        Administration library in MIT Kerberos 5 release krb5-1.3.5
        and earlier has a heap buffer overflow in code which handles
        password history, possibly allowing authenticated attackers to
        execute arbitrary code on a KDC host.

ACKNOWLEDGMENTS
===============

Thanks to Michael Tautschnig for reporting this problem.

Thanks to Chaskiel Grundman and Luke Howard for providing debugging
help on the mailing list.

DETAILS
=======

The vulnerable function is add_to_history() in
src/lib/kadm5/srv/svr_principal.c.  The password history is stored as
a ring buffer, represented as an array of osa_pw_ent_rec, which is
adb->old_keys.  The "next" pointer is an index into the array,
adb->old_key_next, and the length of the array is stored in
adb->old_key_len.  The array is dynamically resized as needed, and
there is no separate head pointer.

The policy's history count is stored in pol->pw_hist_num, but the
actual maximum number of keys stored in adb->old_keys is
pol->pw_hist_num-1, since the "current" key data are also used for
history comparisons when a password change occurs.

The index value adb->old_key_next is permitted to index to a position
one past the end of the array adb->old_keys if adb->old_key_next is
less than pol->pw_hist_num-1.  This out-of-bounds indexing is usually
fixed up when add_to_history() enlarges the array on a subsequent
call.

If pol->pw_hist_num is reduced to adb->old_key_next after a password
change that causes adb->old_key_next to index out of bounds, a
subsequent password change will not run the resizing code, and
add_to_history() will write a password history entry past the end of
the array adb->old_keys.

REVISION HISTORY
================

2004-12-20      original release

Copyright (C) 2004 Massachusetts Institute of Technology
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (SunOS)

iQCVAwUBQcdAH6bDgE/zdoE9AQEWogQAy7vS1GLO5gG/uX9rm15NUQEO5K07NaMu
MdwZhITIR0tg5aIR2eecon1ahgdDFrZELnZ3G/+ArhLqH+yvmskmOLZGmRHQ9Q0l
mMf4DbOWMQZgGNmbvTTAzg0GAuVYdw2+5acP7maj61O0nV9mQIOdeM7Y0HFj46QL
EVf4jR0OsJY=
=ZAwT
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQceaTih9+71yA2DNAQJUWAP+KCv7O49WfU24I2P3hnVZE9isUOxMMvHR
tl1uX72BnzGr+v85IgLLj7ohDQr4YhKcxSZtZeD40SKTTL3mBHqfX2FF5XoGXZPw
h/76DeGms27QLiFs/2fhwr7VrFMJq5xb+6ytDRAAAQtykLgkyEAz1z9I6VVtLpUb
eDLKkAgFJSE=
=skoT
-----END PGP SIGNATURE-----