Double free vulnerability in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x before 1.8.2 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a request associated with (1) renewal or (2) validation.

The remote host is affected by the vulnerability described in GLSA-201201-13 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the administration daemon or the Key Distribution Center       (KDC) daemon, cause a Denial of Service condition, or possibly obtain       sensitive information. Furthermore, a remote attacker may be able to       spoof Kerberos authorization, modify KDC responses, forge user data       messages, forge tokens, forge signatures, impersonate a client, modify       user-visible prompt text, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

USN-940-1 fixed vulnerabilities in Kerberos. This update provides the corresponding updates for Ubuntu 10.04.

Joel Johnson, Brian Almeida, and Shawn Emery discovered that Kerberos did not correctly verify certain packet structures. An unauthenticated remote attacker could send specially crafted traffic to cause the KDC or kadmind services to crash, leading to a denial of service.
(CVE-2010-1320, CVE-2010-1321).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Joel Johnson reported a possible double-free in the Kerberos KDC (MITKRB5-SA-2010-004, CVE-2010-1320). This update adds the upstream fix for this bug.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of Mac OS X 10.6 earlier than 10.6.4 are potentially affected by multiple vulnerabilities.  Mac OS X 10.6.4 contains security fixes for the following products :

  - CUPS

  - DesktopServices

  - Flash Player plug-in

  - Folder Manager

  - Help Viewer

  - iChat

  - ImageIO

Kerberos

  - libcurl

  - Network Authorization

  - Open Directory

  - Printer Setup

  - Printing

  - Ruby

  - SMB File Server

  - SquirrelMail

  - Wiki Server

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4.

Mac OS X 10.6.4 contains security fixes for the following components :

  - CUPS
  - DesktopServices
  - Flash Player plug-in
  - Folder Manager
  - Help Viewer
  - iChat
  - ImageIO
  - Kerberos
  - Kernel
  - libcurl
  - Network Authorization
  - Open Directory
  - Printer Setup
  - Printing
  - Ruby
  - SMB File Server
  - SquirrelMail
  - Wiki Server

It was discovered that Kerberos did not correctly free memory in the GSSAPI and kdb libraries. If a remote attacker were able to manipulate an application using these libraries carefully, the service could crash, leading to a denial of service. (Only Ubuntu 6.06 LTS was affected.) (CVE-2007-5902, CVE-2007-5971, CVE-2007-5972)

Joel Johnson, Brian Almeida, and Shawn Emery discovered that Kerberos did not correctly verify certain packet structures. An unauthenticated remote attacker could send specially crafted traffic to cause the KDC or kadmind services to crash, leading to a denial of service.
(CVE-2010-1320, CVE-2010-1321).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Specially crafted requests be authenticated remote attackers could crash the KDC (CVE-2010-1320).

The MIT Kerberos team reports :

An authenticated remote attacker can crash the KDC by inducing the KDC to perform a double free. Under some circumstances on some platforms, this could also allow malicious code execution.

ID	Name	Product	Family	Severity
57655	GLSA-201201-13 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
47799	Ubuntu 10.04 LTS : krb5 vulnerability (USN-940-2)	Nessus	Ubuntu Local Security Checks	medium
47455	Fedora 12 : krb5-1.7.1-7.fc12 (2010-7130)	Nessus	Fedora Local Security Checks	medium
47454	Fedora 13 : krb5-1.7.1-8.fc13 (2010-7102)	Nessus	Fedora Local Security Checks	medium
800793	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5571	Mac OS X 10.6 < 10.6.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
47023	Mac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
46688	Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 : krb5 vulnerabilities (USN-940-1)	Nessus	Ubuntu Local Security Checks	critical
45607	openSUSE Security Update : krb5 (openSUSE-SU-2010:0147-1)	Nessus	SuSE Local Security Checks	medium
45595	FreeBSD : krb5 -- KDC double free vulnerability (86b8b655-4d1a-11df-83fb-0015587e2cc1)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2010-1320

high

Tenable Plugins

medium

medium

medium

medium

high

critical

high

critical

medium

medium