Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code.

An advisory published by the MIT Kerberos team says :

The MIT Kerberos 5 implementation's Key Distribution Center (KDC) program contains a double-free vulnerability that potentially allows a remote attacker to execute arbitrary code. Compromise of a KDC host compromises the security of the entire authentication realm served by the KDC. Additionally, double-free vulnerabilities exist in MIT Kerberos 5 library code, making client programs and application servers vulnerable.

Double-free vulnerabilities of this type are not believed to be exploitable for code execution on FreeBSD systems. However, the potential for other ill effects may exist.

The remote host is missing Security Update 2004-12-02. This security update contains a number of fixes for the following programs :

  - Apache
  - Apache2
  - AppKit
  - Cyrus IMAP
  - HIToolbox
  - Kerberos
  - Postfix
  - PSNormalizer
  - QuickTime Streaming Server
  - Safari
  - Terminal

These programs contain multiple vulnerabilities that could allow a remote attacker to execute arbitrary code.

The MIT Kerberos Development Team has discovered a number of vulnerabilities in the MIT Kerberos Version 5 software. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CAN-2004-0642 [VU#795632]     A double-free error may allow unauthenticated remote     attackers to execute arbitrary code on KDC or clients.

  - CAN-2004-0643 [VU#866472]

    Several double-free errors may allow authenticated     attackers to execute arbitrary code on Kerberos     application servers.

  - CAN-2004-0644 [VU#550464]

    A remotely exploitable denial of service vulnerability     has been found in the KDC and libraries.

  - CAN-2004-0772 [VU#350792]

    Several double-free errors may allow remote attackers to     execute arbitrary code on the server. This does not     affect the version in woody.

A double-free vulnerability exists in the MIT Kerberos 5's KDC program that could potentially allow a remote attacker to execute arbitrary code on the KDC host. As well, multiple double-free vulnerabilities exist in the krb5 library code, which makes client programs and application servers vulnerable. The MIT Kerberos 5 development team believes that exploitation of these bugs would be difficult and no known vulnerabilities are believed to exist. The vulnerability in krb524d was discovered by Marc Horowitz; the other double-free vulnerabilities were discovered by Will Fiveash and Nico Williams at Sun.

Will Fiveash and Nico Williams also found another vulnerability in the ASN.1 decoder library. This makes krb5 vulnerable to a DoS (Denial of Service) attack causing an infinite loop in the decoder. The KDC is vulnerable to this attack.

The MIT Kerberos 5 team has provided patches which have been applied to the updated software to fix these issues. Mandrakesoft encourages all users to upgrade immediately.

The remote host is affected by the vulnerability described in GLSA-200409-09 (MIT krb5: Multiple vulnerabilities)

    The implementation of the Key Distribution Center (KDC) and the MIT krb5     library contain double-free vulnerabilities, making client programs as well     as application servers vulnerable.
    The ASN.1 decoder library is vulnerable to a denial of service attack,     including the KDC.
  Impact :

    The double-free vulnerabilities could allow an attacker to execute     arbitrary code on a KDC host and hosts running krb524d or vulnerable     services. In the case of a KDC host, this can lead to a compromise of the     entire Kerberos realm. Furthermore, an attacker impersonating a legitimate     KDC or application server can potentially execute arbitrary code on     authenticating clients.
    An attacker can cause a denial of service for a KDC or application server     and clients, the latter if impersonating a legitimate KDC or application     server.
  Workaround :

    There is no known workaround at this time.

Updated krb5 packages that improve client responsiveness and fix several security issues are now available for Red Hat Enterprise Linux 3.

Kerberos is a networked authentication system that uses a trusted third party (a KDC) to authenticate clients and servers to each other.

Several double-free bugs were found in the Kerberos 5 KDC and libraries. A remote attacker could potentially exploit these flaws to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0642 and CVE-2004-0643 to these issues.

A double-free bug was also found in the krb524 server (CVE-2004-0772), however this issue does not affect Red Hat Enterprise Linux 3 Kerberos packages.

An infinite loop bug was found in the Kerberos 5 ASN.1 decoder library. A remote attacker may be able to trigger this flaw and cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0644 to this issue.

When attempting to contact a KDC, the Kerberos libraries will iterate through the list of configured servers, attempting to contact each in turn. If one of the servers becomes unresponsive, the client will time out and contact the next configured server. When the library attempts to contact the next KDC, the entire process is repeated. For applications which must contact a KDC several times, the accumulated time spent waiting can become significant.

This update modifies the libraries, notes which server for a given realm last responded to a request, and attempts to contact that server first before contacting any of the other configured servers.

All users of krb5 should upgrade to these updated packages, which contain backported security patches to resolve these issues.

Updated kerberos packages fix a number of vulnerabilities found in MIT Kerberos.

Kerberos is a network authentication system. The MIT Kerberos team released an advisory describing a number of vulnerabilities that affect the kerberos packages shipped by Red Hat.

An integer signedness error in the ASN.1 decoder before version 1.2.5 allows remote attackers to cause a denial of service via a large unsigned data element length, which is later used as a negative value.
The Common Vulnerabilities and Exposures project has assigned the name CVE-2002-0036 to this issue.

The Key Distribution Center (KDC) before version 1.2.5 allows remote, authenticated, attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that :

  - causes a NULL pointer dereference (CVE-2003-0058).

  - causes the KDC to corrupt its heap (CVE-2003-0082).

A vulnerability in Kerberos before version 1.2.3 allows users from one realm to impersonate users in other realms that have the same inter-realm keys (CVE-2003-0059).

The MIT advisory for these issues also mentions format string vulnerabilities in the logging routines (CVE-2003-0060). Previous versions of the kerberos packages from Red Hat already contain fixes for this issue.

Vulnerabilities have been found in the implementation of support for triple-DES keys in the implementation of the Kerberos IV authentication protocol included in MIT Kerberos (CVE-2003-0139).

Vulnerabilities have been found in the Kerberos IV authentication protocol which allow an attacker with knowledge of a cross-realm key that is shared with another realm to impersonate any principal in that realm to any service in that realm. This vulnerability can only be closed by disabling cross-realm authentication in Kerberos IV (CVE-2003-0138).

Vulnerabilities have been found in the RPC library used by the kadmin service in Kerberos 5. A faulty length check in the RPC library exposes kadmind to an integer overflow which can be used to crash kadmind (CVE-2003-0028).

All users of Kerberos are advised to upgrade to these errata packages, which disable cross-realm authentication by default for Kerberos IV and which contain backported patches to correct these issues.

The remote host is running Kerberos 5.

There are multiple flaws that affect this product. Make sure you are running the latest version with the latest patches.

Note that Nessus could not check for any of the flaws and solely relied on the presence of the service to issue an alert, so this might be a false positive.

ID	Name	Product	Family	Severity
37617	FreeBSD : krb5 -- double-free vulnerabilities (86a98b57-fb8e-11d8-9343-000a95bc6fae)	Nessus	FreeBSD Local Security Checks	high
15898	Mac OS X Multiple Vulnerabilities (Security Update 2004-12-02)	Nessus	MacOS X Local Security Checks	high
15380	Debian DSA-543-1 : krb5 - several vulnerabilities	Nessus	Debian Local Security Checks	high
14673	Mandrake Linux Security Advisory : krb5 (MDKSA-2004:088)	Nessus	Mandriva Local Security Checks	high
14666	GLSA-200409-09 : MIT krb5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
14595	RHEL 3 : krb5 (RHSA-2004:350)	Nessus	Red Hat Local Security Checks	high
12364	RHEL 2.1 : krb5 (RHSA-2003:052)	Nessus	Red Hat Local Security Checks	high
11512	Kerberos 5 < 1.3.5 Multiple Vulnerabilities	Nessus	Misc.	high

Detections

Analytics

CVE-2004-0772

critical

Tenable Plugins

high

high

high

high

high

high

high

high