The kadm_ser_in function in (1) the Kerberos v4compatibility administration daemon (kadmind4) in the MIT Kerberos 5 (krb5) krb5-1.2.6 and earlier, (2) kadmind in KTH Kerberos 4 (eBones) before 1.2.1, and (3) kadmind in KTH Kerberos 5 (Heimdal) before 0.5.1 when compiled with Kerberos 4 support, does not properly verify the length field of a request, which allows remote attackers to execute arbitrary code via a buffer overflow attack.

A stack-based buffer overflow in the kadm_ser_wrap_in function in the Kerberos v4 administration server was discovered, which is provided by Heimdal as well. A working exploit for this kadmind bug is already circulating, hence it is considered serious. The broken library also contains a vulnerability which could lead to another root exploit.

These problems have been fixed in version 0.4e-7.woody.5 for the current stable distribution (woody), in version 0.2l-7.6 for the old stable distribution (potato) and in version 0.4e-22 for the unstable distribution (sid).

Tom Yu and Sam Hartman of MIT discovered another stack-based buffer overflow in the kadm_ser_wrap_in function in the Kerberos v4 administration server. This kadmind bug has a working exploit code circulating, hence it is considered serious.

Tom Yu and Sam Hartman of MIT discovered another stack-based buffer overflow in the kadm_ser_wrap_in function in the Kerberos v4 administration server. This kadmind bug has a working exploit code circulating, hence it is considered serious. The MIT krb5 implementation includes support for version 4, including a complete v4 library, server side support for krb4, and limited client support for v4.

The SuSE Security Team has reviewed critical parts of the Heimdal package such as the kadmind and kdc server. While doing so several potential buffer overflows and other bugs have been uncovered and fixed. Remote attackers can probably gain remote root access on systems without fixes. Since these services usually run on authentication servers these bugs are considered very serious.

These problems have been fixed in version 0.4e-7.woody.4 for the current stable distribution (woody), in version 0.2l-7.4 for the old stable distribution (potato) and version 0.4e-21 for the unstable distribution (sid).

A stack-based buffer overflow in the implementation of the Kerberos v4 compatibility administration daemon (kadmind4) in the krb5 package can be exploited to gain unauthorized root access to a KDC host.
Authentication to the daemon is not required to successfully perform the attack and according to MIT at least one exploit is known to exist. kadmind4 is used only by sites that require compatibility with legacy administrative clients, and sites that do not have these needs are likely not using kadmind4 and are not affected.

MandrakeSoft encourages all users who use Kerberos to upgrade to these packages immediately.

Update :

The /etc/rc.d/init.d/kadmin initscript improperly pointed to a non-existent location for the kadmind binary. This update corrects the problem.

A remotely exploitable stack-based buffer overflow has been found in the Kerberos v4 compatibility administration daemon distributed with the Red Hat Linux krb5 packages.

[Updated 09 Jan 2003] Added fixed packages for the Itanium (IA64) architecture.

Kerberos is a network authentication system.

A stack-based buffer overflow has been found in the implementation of the Kerberos v4 compatibility administration daemon (kadmind4), which is part of the MIT krb5 distribution. This vulnerability is present in version 1.2.6 and earlier of the MIT krb5 distribution and can be exploited to gain unauthorized root access to a KDC host. The attacker does not need to authenticate to the daemon to successfully perform this attack.

kadmind4 is included in the Kerberos packages in Red Hat Linux Advanced Server but is not enabled or used by default.

All users of Kerberos are advised to upgrade to these errata packages which contain a backported patch and are not vulnerable to this issue.

ID	Name	Product	Family	Severity
15022	Debian DSA-185-1 : heimdal - buffer overflow	Nessus	Debian Local Security Checks	critical
15021	Debian DSA-184-1 : krb4 - buffer overflow	Nessus	Debian Local Security Checks	critical
15020	Debian DSA-183-1 : krb5 - buffer overflow	Nessus	Debian Local Security Checks	critical
15015	Debian DSA-178-1 : heimdal - remote command execution	Nessus	Debian Local Security Checks	critical
13973	Mandrake Linux Security Advisory : krb5 (MDKSA-2002:073-1)	Nessus	Mandriva Local Security Checks	critical
12331	RHEL 2.1 : krb5 (RHSA-2002:250)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2002-1235

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical