Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2011.0434 MITKRB5-SA-2011-004: kadmind invalid pointer free() 14 April 2011 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kadmind Publisher: MIT Operating System: UNIX variants (UNIX, Linux, OSX) Impact/Access: Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2011-0285 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 MITKRB5-SA-2011-004 MIT krb5 Security Advisory 2011-004 Original release: 2011-04-12 Last update: 2011-04-12 Topic: kadmind invalid pointer free() CVE-2011-0285 CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C CVSSv2 Base Score: 10 Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete CVSSv2 Temporal Score: 7.8 Exploitability: Proof-of-Concept Remediation Level: Official Fix Report Confidence: Confirmed SUMMARY ======= The password-changing capability of the MIT krb5 administration daemon (kadmind) has a bug that can cause it to attempt to free() an invalid pointer under certain error conditions. This can cause the daemon to crash or induce the execution of arbitrary code (which is believed to be difficult). No exploit that executes arbitrary code is known to exist, but it is easy to trigger a denial of service manually. IMPACT ====== An unauthenticated remote attacker can cause the kadmind to terminate, resulting in a denial of service. The attacker might be able to remotely execute code on the host running kadmind, but exploiting the freeing of an invalid pointer to execute arbitrary code is believed to be difficult. Some platforms detect attempted freeing of invalid pointers and protectively terminate the process, preventing arbitrary code execution on those platforms. AFFECTED SOFTWARE ================= * kadmind in MIT releases krb5-1.7 and later is vulnerable. Earlier releases do not contain the functionality that the vulnerable code implements. FIXES ===== * Workaround: restart the kadmind when it crashes, possibly using an automated monitoring process. * Upcoming releases in the krb5-1.7.x, krb5-1.8.x, and krb5-1.9.x series will contain fixes. * For the krb5-1.9 release, apply the following patch: diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c index 1124445..0056885 100644 - - --- a/src/kadmin/server/schpw.c +++ b/src/kadmin/server/schpw.c @@ -52,6 +52,7 @@ process_chpw_request(context, server_handle, realm, keytab, ret = 0; rep->length = 0; + rep->data = NULL; auth_context = NULL; changepw = NULL; @@ -76,8 +77,13 @@ process_chpw_request(context, server_handle, realm, keytab, plen = (*ptr++ & 0xff); plen = (plen<<8) | (*ptr++ & 0xff); - - - if (plen != req->length) - - - return(KRB5KRB_AP_ERR_MODIFIED); + if (plen != req->length) { + ret = KRB5KRB_AP_ERR_MODIFIED; + numresult = KRB5_KPASSWD_MALFORMED; + strlcpy(strresult, "Request length was inconsistent", + sizeof(strresult)); + goto chpwfail; + } /* verify version number */ @@ -531,6 +537,10 @@ cleanup: if (local_kaddrs != NULL) krb5_free_addresses(server_handle->context, local_kaddrs); + if ((*response)->data == NULL) { + free(*response); + *response = NULL; + } krb5_kt_close(server_handle->context, kt); return ret; This patch is also available at http://web.mit.edu/kerberos/advisories/2011-004-patch.txt A PGP-signed patch is available at http://web.mit.edu/kerberos/advisories/2011-004-patch.txt.asc * For the krb5-1.8.x releases, the patch is available at http://web.mit.edu/kerberos/advisories/2011-004-patch-r18.txt A PGP-signed patch is available at http://web.mit.edu/kerberos/advisories/2011-004-patch-r18.txt.asc * For the krb5-1.7.x releases, use the patch for the krb5-1.8.x releases, but apply ignoring whitespace differences ("patch -l"). REFERENCES ========== This announcement is posted at: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt This announcement and related security advisories may be found on the MIT Kerberos security advisory page at: http://web.mit.edu/kerberos/advisories/index.html The main MIT Kerberos web page is at: http://web.mit.edu/kerberos/index.html CVSSv2: http://www.first.org/cvss/cvss-guide.html http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2 CVE: CVE-2011-0285 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0285 http://krbdev.mit.edu/rt/Ticket/Display.html?id=6899 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621726 ACKNOWLEDGMENTS =============== This bug was initially reported to Debian by Felipe Ortega. CONTACT ======= The MIT Kerberos Team security contact address is <krbcore-security@mit.edu>. When sending sensitive information, please PGP-encrypt it using the following key: pub 2048R/56CD8F76 2010-12-29 [expires: 2012-02-01] uid MIT Kerberos Team Security Contact <krbcore-security@mit.edu> DETAILS ======= The dispatch() function in kadmin/server/schpw.c (which handles the password changing protocol) allocates an uninitialized krb5_data structure for the response packet, expecting process_chpw_request() to fill it in. There is remotely-inducible error one path through process_chpw_request() that can return to dispatch() without initializing the data pointer in the krb5_data structure that is to hold the response packet, which will cause process_tcp_connection() in lib/app-utils/net-server.c to free() an invalid pointer (via kill_tcp_or_rpc_connection()). Password change requests that arrive via UDP will not cause kadmind to free() an invalid pointer. Releases krb5-1.7 and krb5-1.8 put some of the above-mentioned functions in different source files, but the execution flow is largely identical. Releases prior to krb5-1.7 did not have the TCP kpasswd capability, and are not vulnerable. REVISION HISTORY ================ 2011-04-12 original release Copyright (C) 2011 Massachusetts Institute of Technology - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (SunOS) iEYEARECAAYFAk2l6RMACgkQSO8fWy4vZo5bjgCgqnWVF2nixIkpdUPI1THkTgLn h6cAn1bBnzjAxGA1fF56e7LNXPMZao+j =9KKM - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iD8DBQFNpkHf/iFOrG6YcBERAjGUAJ9iyn2B1lOUjCLLGA42yVjokHWavwCdEIEx GtrnnjHj2z+5TLJ3oGTcb1s= =K52W -----END PGP SIGNATURE-----