The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.

A remote attacker may be able to make kadmind free an invalid pointer, leading to a crash of the service (CVE-2011-0285).

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0447 advisory.

    [1.8.2-3.7]
    - kadmind: add upstream patch to fix free() on an invalid pointer (#696341,       MITKRB5-SA-2011-004, CVE-2011-0285)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An invalid free flaw was found in the password-changing capability of the MIT Kerberos administration daemon, kadmind. A remote, unauthenticated attacker could use this flaw to cause kadmind to abort via a specially crafted request. (CVE-2011-0285)

After installing the updated packages, the kadmind daemon will be restarted automatically.

The remote host is affected by the vulnerability described in GLSA-201201-13 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the administration daemon or the Key Distribution Center       (KDC) daemon, cause a Denial of Service condition, or possibly obtain       sensitive information. Furthermore, a remote attacker may be able to       spoof Kerberos authorization, modify KDC responses, forge user data       messages, forge tokens, forge signatures, impersonate a client, modify       user-visible prompt text, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

Felipe Ortega discovered that kadmind did not correctly handle password changing error conditions. An unauthenticated remote attacker could exploit this to crash kadmind, leading to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update incorporates the upstream patches to fix an attempt to free an invalid pointer in kadmind (MITKRB5-SA-2011-004).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been found and corrected in krb5 :

The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition (CVE-2011-0285).

The updated packages have been patched to correct this issue.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0447 advisory.

  - krb5: kadmind invalid pointer free() (MITKRB5-SA-004) (CVE-2011-0285)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An advisory published by the MIT Kerberos team says :

The password-changing capability of the MIT krb5 administration daemon (kadmind) has a bug that can cause it to attempt to free() an invalid pointer under certain error conditions. This can cause the daemon to crash or induce the execution of arbitrary code (which is believed to be difficult). No exploit that executes arbitrary code is known to exist, but it is easy to trigger a denial of service manually.

Some platforms detect attempted freeing of invalid pointers and protectively terminate the process, preventing arbitrary code execution on those platforms.

ID	Name	Product	Family	Severity
75884	openSUSE Security Update : krb5 (openSUSE-SU-2011:0348-1)	Nessus	SuSE Local Security Checks	critical
75562	openSUSE Security Update : krb5 (openSUSE-SU-2011:0348-1)	Nessus	SuSE Local Security Checks	critical
68256	Oracle Linux 6 : krb5 (ELSA-2011-0447)	Nessus	Oracle Linux Local Security Checks	critical
61019	Scientific Linux Security Update : krb5 on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
57655	GLSA-201201-13 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
55074	Ubuntu 9.10 / 10.04 LTS / 10.10 : krb5 vulnerability (USN-1116-1)	Nessus	Ubuntu Local Security Checks	critical
53745	openSUSE Security Update : krb5 (openSUSE-SU-2011:0348-1)	Nessus	SuSE Local Security Checks	critical
53555	Fedora 14 : krb5-1.8.2-10.fc14 (2011-5345)	Nessus	Fedora Local Security Checks	critical
53554	Fedora 13 : krb5-1.7.1-19.fc13 (2011-5343)	Nessus	Fedora Local Security Checks	critical
53538	Mandriva Linux Security Advisory : krb5 (MDVSA-2011:077)	Nessus	Mandriva Local Security Checks	critical
53467	Fedora 15 : krb5-1.9-7.fc15 (2011-5333)	Nessus	Fedora Local Security Checks	critical
53445	RHEL 6 : krb5 (RHSA-2011:0447)	Nessus	Red Hat Local Security Checks	critical
53442	FreeBSD : krb5 -- MITKRB5-SA-2011-004, kadmind invalid pointer free() [CVE-2011-0285] (6a3c3e5c-66cb-11e0-a116-c535f3aa24f0)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2011-0285

critical

Tenable Plugins

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical