Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.

eEye Digital Security discovered an integer overflow in the xdrmem_getbytes() function which is also present in GNU libc. This function is part of the XDR (external data representation) encoder/decoder derived from Sun's RPC implementation. Depending upon the application, this vulnerability can cause buffer overflows and could possibly be exploited to execute arbitrary code.

eEye Digital Security discovered an integer overflow in the xdrmem_getbytes() function of glibc, that is also present in dietlibc, a small libc useful especially for small and embedded systems. This function is part of the XDR encoder/decoder derived from Sun's RPC implementation. Depending upon the application, this vulnerability can cause buffer overflows and could possibly be exploited to execute arbitrary code.

Several vulnerabilities have been discovered in krb5, an implementation of MIT Kerberos.

  - A cryptographic weakness in version 4 of the Kerberos     protocol allows an attacker to use a chosen-plaintext     attack to impersonate any principal in a realm.
    Additional cryptographic weaknesses in the krb4     implementation included in the MIT krb5 distribution     permit the use of cut-and-paste attacks to fabricate     krb4 tickets for unauthorized client principals if     triple-DES keys are used to key krb4 services. These     attacks can subvert a site's entire Kerberos     authentication infrastructure.
    Kerberos version 5 does not contain this cryptographic     vulnerability. Sites are not vulnerable if they have     Kerberos v4 completely disabled, including the disabling     of any krb5 to krb4 translation services.

  - The MIT Kerberos 5 implementation includes an RPC     library derived from SUNRPC. The implementation contains     length checks, that are vulnerable to an integer     overflow, which may be exploitable to create denials of     service or to gain unauthorized access to sensitive     information.
  - Buffer overrun and underrun problems exist in Kerberos     principal name handling in unusual cases, such as names     with zero components, names with one empty component, or     host-based service principal names with no host name     component.

This version of the krb5 package changes the default behavior and disallows cross-realm authentication for Kerberos version 4. Because of the fundamental nature of the problem, cross-realm authentication in Kerberos version 4 cannot be made secure and sites should avoid its use. A new option (-X) is provided to the krb5kdc and krb524d commands to re-enable version 4 cross-realm authentication for those sites that must use this functionality but desire the other security fixes.

Multiple vulnerabilities have been found in the Kerberos network authentication system. The MIT Kerberos team have released an advisory detailing these vulnerabilities, a description of which follows.

An integer signedness error in the ASN.1 decoder before version 1.2.5 allows remote attackers to cause a crash of the server via a large unsigned data element length, which is later used as a negative value (CVE-2002-0036). Mandrake Linux 9.0+ is not affected by this problem.

Vulnerabilities have been found in the RPC library used by the kadmin service. A faulty length check in the RPC library exposes kadmind to an integer overflow which can be used to crash kadmind (CVE-2003-0028).

The KDC (Key Distribution Center) before version 1.2.5 allows remote, authenticated attackers to cause a crash on KDCs within the same realm using a certain protocol that causes a null dereference (CVE-2003-0058). Mandrake Linux 9.0+ is not affected by this problem.

Users from one realm can impersonate users in other realms that have the same inter-realm keys due to a vulnerability in Kerberos 1.2.3 and earlier (CVE-2003-0059). Mandrake Linux 9.0+ is not affected by this problem.

The KDC allows remote, authenticated users to cause a crash on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (CVE-2003-0072).

The KDC allows remote, authenticated users to cause a crash on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (CVE-2003-0082).

Vulnerabilities have been discovered in the Kerberos IV authentication protocol which allow an attacker with knowledge of a cross-realm key, which is shared in another realm, to impersonate a principle in that realm to any service in that realm. This vulnerability can only be closed by disabling cross-realm authentication in Kerberos IV (CVE-2003-0138).

Vulnerabilities have been discovered in the support for triple-DES keys in the Kerberos IV authentication protocol which is included in MIT Kerberos (CVE-2003-0139).

MandrakeSoft encourages all users to upgrade to these updated packages immediately which contain patches to correct all of the previously noted vulnerabilities. These packages also disable Kerberos IV cross-realm authentication by default.

Update :

The packages for Mandrake Linux 9.1 and 9.1/PPC were not GPG-signed.
This has been fixed and as a result the md5sums have changed. Thanks to Mark Lyda for pointing this out.

An integer overflow was discovered by eEye Digital Security in the xdrmem_getbytes() function of glibc 2.3.1 and earlier. This function is part of the XDR encoder/decoder derived from Sun's RPC implementation. Depending upon the application, this vulnerability can cause buffer overflows and could possibly be exploited to execute arbitrary code.

The provided packages contain patches that correct this issue and all users should upgrade. Please note that users of Mandrake Linux 9.1 already have this fix in the 9.1-released glibc packages.

The remote host is missing the patch for the advisory SUSE-SA:2003:027 (glibc).


Another integer overflow was found in glibc' XDR code. This bug is equal

Updated glibc packages are available to fix an integer overflow in the XDR decoder.

The glibc package contains standard libraries which are used by multiple programs on the system. Sun RPC is a remote procedure call framework which allows clients to invoke procedures in a server process over a network. XDR is a mechanism for encoding data structures for use with RPC. NFS, NIS, and many other network services are built upon Sun RPC. The XDR encoder/decoder provided with glibc, derived from Sun's RPC implementation, was demonstrated to be vulnerable to an integer overflow.

An integer overflow is present in the xdrmem_getbytes() function of glibc 2.3.1 and earlier. Depending upon the application, this vulnerability could cause buffer overflows and may be exploitable, leading to arbitrary code execution.

All users should upgrade to these errata packages which contain patches to the glibc libraries and, therefore, are not vulnerable to these issues.

Red Hat would like to thank eEye Digital Security for alerting us to this issue.

Updated kerberos packages fix a number of vulnerabilities found in MIT Kerberos.

Kerberos is a network authentication system. The MIT Kerberos team released an advisory describing a number of vulnerabilities that affect the kerberos packages shipped by Red Hat.

An integer signedness error in the ASN.1 decoder before version 1.2.5 allows remote attackers to cause a denial of service via a large unsigned data element length, which is later used as a negative value.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2002-0036 to this issue.

The Key Distribution Center (KDC) before version 1.2.5 allows remote, authenticated, attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that :

  - causes a NULL pointer dereference (CVE-2003-0058).

  - causes the KDC to corrupt its heap (CVE-2003-0082).

A vulnerability in Kerberos before version 1.2.3 allows users from one realm to impersonate users in other realms that have the same inter-realm keys (CVE-2003-0059).

The MIT advisory for these issues also mentions format string vulnerabilities in the logging routines (CVE-2003-0060). Previous versions of the kerberos packages from Red Hat already contain fixes for this issue.

Vulnerabilities have been found in the implementation of support for triple-DES keys in the implementation of the Kerberos IV authentication protocol included in MIT Kerberos (CVE-2003-0139).

Vulnerabilities have been found in the Kerberos IV authentication protocol which allow an attacker with knowledge of a cross-realm key that is shared with another realm to impersonate any principal in that realm to any service in that realm. This vulnerability can only be closed by disabling cross-realm authentication in Kerberos IV (CVE-2003-0138).

Vulnerabilities have been found in the RPC library used by the kadmin service in Kerberos 5. A faulty length check in the RPC library exposes kadmind to an integer overflow which can be used to crash kadmind (CVE-2003-0028).

All users of Kerberos are advised to upgrade to these errata packages, which disable cross-realm authentication by default for Kerberos IV and which contain backported patches to correct these issues.

The RPC library has an integer overflow in the function xdrmem_getbytes(). 

An attacker may use this flaw to execute arbitrary code on this host with the privileges your RPC programs are running with (typically root), by sending a specially crafted request to them. 

Note that this issue affects Solaris, as well as Red Hat Enterprise Linux and Fedora.

Nessus used this flaw to crash the portmapper.

ID	Name	Product	Family	Severity
15119	Debian DSA-282-1 : glibc - integer overflow	Nessus	Debian Local Security Checks	high
15109	Debian DSA-272-1 : dietlibc - integer overflow	Nessus	Debian Local Security Checks	high
15103	Debian DSA-266-1 : krb5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
14027	Mandrake Linux Security Advisory : krb5 (MDKSA-2003:043-1)	Nessus	Mandriva Local Security Checks	high
14021	Mandrake Linux Security Advisory : glibc (MDKSA-2003:037)	Nessus	Mandriva Local Security Checks	high
13796	SUSE-SA:2003:027: glibc	Nessus	SuSE Local Security Checks	high
12377	RHEL 2.1 : glibc (RHSA-2003:090)	Nessus	Red Hat Local Security Checks	high
12364	RHEL 2.1 : krb5 (RHSA-2003:052)	Nessus	Red Hat Local Security Checks	high
11420	Sun RPC XDR xdrmem_getbytes Function Remote Overflow	Nessus	RPC	critical

Detections

Analytics

CVE-2003-0028

critical

Tenable Plugins

high

high

high

high

high

high

high

high

critical