[CLA-2003:639] Conectiva Security Announcement - krb5
Date: Mon, 5 May 2003 16:25:23 -0300
From: Conectiva Updates <[email protected]>
To: [email protected], [email protected],
Subject: [CLA-2003:639] Conectiva Security Announcement - krb5
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : krb5
SUMMARY : Several Kerberos vulnerabilities
DATE : 2003-05-05 16:23:00
ID : CLA-2003:639
RELEVANT
RELEASES : 8
- -------------------------------------------------------------------------
DESCRIPTION
The "krb5" packages are MIT's[1] implementation of the Kerberos 5
authentication protocol.
This update fixes the vulnerabilities outlined below:
1. Principal name handling vulnerabilities[2] (CAN-2003-0082[3] and
CAN-2003-0072[4])
Nalin Dahyabhai discovered buffer overrun and underrun problems in
the code that handles Kerberos principal names. When presented with
some unusual names, such as names with zero components, names with
one empty component, or host-based service principal names with no
host name component, at least a program crash would result.
2. Cryptographic weaknesses in Kerberos v4 protocol[5]
(CAN-2003-0138[6] and CAN-2003-0139[7])
A weakness in the Kerberos v4 protocol allows an attacker to
impersonate any principal in a realm. If done against cross-realm
principals, such an attack could lead to the compromise of other
realms which share a cross-realm key with the local realm. This
update disabled Kerberos 4 cross-realm authentication by default.
Additionally, MIT's implementation of the Kerberos 4 protocol
included in the krb5 package allow an attacker to fabricate krb4
tickets if 3DES keys are used.
3. Faulty length checks in xdrmem_getbytes[8] (CAN-2003-0028[9])
The xdrmem_*() family of functions (such as xdrmem_getbytes()) from
the XDR library used by MIT Kerberos contains integer overflows that
may be exploited by remote (but authenticated) attackers to cause a
denial of service condition or even expose sensitive information.
4. Multiple vulnerabilities in old releases of MIT Kerberos[10]
- ASN.1 decoding flaw[11]: the ASN.1 decoder contains integer
signedness errors which could be used by remote attackers to crash
the program;
- KDC null pointer dereference[12]: a remote attacker could make the
KDC attempt to dereference a NULL pointer, resulting in a program
crash and a denial of service condition;
- Inter-realm user impersonation[13] and format string
vulnerability[14] (cited in MIT's advisory but already fixed in our
previous 1.2.3 package)
This announcement upgrades the Kerberos packages in Conectiva Linux 8
to the 1.2.8 version. Please note that Conectiva Linux 9 includes a
patched 1.2.7 version and is not vulnerable to these issues.
SOLUTION
It is recommended that all Kerberos users in Conectiva Linux 8
upgrade their packages. Please note that the service will be
automatically restarted after the upgrade if it was already running.
Several applications can make use of the Kerberos libraries. It is
recommended that those applications be restarted as well. A list of
such applications can be obtained right after the upgrade by running
the following command:
lsof | grep \;
REFERENCES
1.http://web.mit.edu/Kerberos/www/index.html
2.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0082
4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0072
5.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-004-krb4.txt
6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0138
7.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0139
8.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-003-xdr.txt
9.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0028
10.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt
11.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0036
12.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0058
13.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0059
14.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0060
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/SRPMS/krb5-1.2.8-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-apps-clients-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-apps-servers-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-client-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-devel-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-devel-static-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-doc-1.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-server-1.2.8-1U80_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com
- -------------------------------------------------------------------------
subscribe: [email protected]
unsubscribe: [email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE+trqi42jd0JmAcZARAo1VAKCp14kfkJw+7tIh8/HNx8XqUD8P4ACgpZ/E
LF+Uk/oc3zdBbrEcD3Y+5PU=
=T48R
-----END PGP SIGNATURE-----
