Kerberos krb425_conv_principal buffer overflow
| kerberos-krb425-conv-principal-bo (4520) |  High Risk |
Description:
MIT Kerberos 5 is vulnerable to a buffer overflow in the krb425_conv_principal library function, which is part of the Kerberos 4 compatibility code. When used in conjunction with a vulnerability in krb_rd_req, a remote attacker could exploit this buffer overflow to gain root access to the system.
Platforms Affected:
- Cygnus, Cygnus KerbNet
- MIT, Kerberos 5-1.0
- MIT, Kerberos 5-1.1
- MIT, Kerberos 5-1.1.1
Remedy:
Upgrade to MIT Kerberos 5 version 1.2 when it becomes available.
As a workaround, apply the appropriate MIT patch, available from the CERT Web site. As an alternative, in Kerberos 5, it may be possible to disable Kerberos 4 authentication. More information on these workarounds is included in CERT Advisory CA-2000-06. See References.
For FreeBSD:
Upgrade the ports collection, as listed in FreeBSD Security Advisory FreeBSD-SA-00:20. See References.
For Red Hat Linux:
Upgrade to Kerberos 5 1.1.1-16, as listed in RHSA-2000:025-08. See References.
Consequences:
Gain Access
References:
- CERT Advisory CA-2000-06, Multiple Buffer Overflows in Kerberos Authenticated Services at http://www.cert.org/advisories/CA-2000-06.html.
- CIAC Information Bulletin K-043b, Buffer Overrun Vulnerabilities in Kerberos at http://www.ciac.org/ciac/bulletins/k-043.shtml.
- FreeBSD Security Advisory FreeBSD-SA-00:20, krb5 port contains remote and local root exploits. at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:20.krb5.asc.
- FreeBSD Security Advisory FreeBSD-SA-00:33, kerberosIV distribution contains multiple vulnerabilities under FreeBSD 3.x at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:33.kerberosIV.asc.
- Kerberos Security Advisory, BUFFER OVERRUN VULNERABILITIES IN KERBEROS at http://web.mit.edu/kerberos/www/advisories/krb4buf.txt.
- RHSA-2000:025-08, Kerberos 5 packages at http://rhn.redhat.com/errata/RHSA-2000-025.html.
- BID-1220: Multiple Vendor Kerberos 5/Kerberos 4 Compatibility krb_rd_req() Buffer Overflow Vulnerability
- CVE-2000-0390: Buffer overflow in krb425_conv_principal function in Kerberos 5 allows remote attackers to gain root privileges.
- OSVDB ID: 4884: Kerberos 5 krb425_conv_principal Remote Overflow
Reported:
May 17, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net