Kerberos krshd buffer overflow
| kerberos-krshd-bo (4521) |  High Risk |
Description:
MIT Kerberos is vulnerable to a buffer overflow in krshd that could allow a remote user to execute arbitrary code as root.
Platforms Affected:
- Cygnus, Cygnus KerbNet
- MIT, Kerberos 5-1.0
- MIT, Kerberos 5-1.1
- MIT, Kerberos 5-1.1.1
Remedy:
Upgrade to MIT Kerberos 5 version 1.2 when it becomes available.
As a workaround, apply the appropriate MIT patch, available from the CERT Web site. As an alternative, in Kerberos 5, it may be possible to disable Kerberos 4 authentication. More information on these workarounds is included in CERT Advisory CA-2000-06. See References.
For FreeBSD:
Upgrade the ports collection, as listed in FreeBSD Security Advisory FreeBSD-SA-00:20. See References.
For Red Hat Linux:
Upgrade to Kerberos 5 1.1.1-16, as listed in RHSA-2000:025-08. See References.
Consequences:
Gain Access
References:
- CERT Advisory CA-2000-06, Multiple Buffer Overflows in Kerberos Authenticated Services at http://www.cert.org/advisories/CA-2000-06.html.
- CIAC Information Bulletin K-043b, Buffer Overrun Vulnerabilities in Kerberos at http://www.ciac.org/ciac/bulletins/k-043.shtml.
- FreeBSD Security Advisory FreeBSD-SA-00:20, krb5 port contains remote and local root exploits. at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:20.krb5.asc.
- FreeBSD Security Advisory FreeBSD-SA-00:33, kerberosIV distribution contains multiple vulnerabilities under FreeBSD 3.x at ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:33.kerberosIV.asc.
- Kerberos Security Advisory, BUFFER OVERRUN VULNERABILITIES IN KERBEROS at http://web.mit.edu/kerberos/www/advisories/krb4buf.txt.
- RHSA-2000:025-08, Kerberos 5 packages at http://rhn.redhat.com/errata/RHSA-2000-025.html.
- BID-1220: Multiple Vendor Kerberos 5/Kerberos 4 Compatibility krb_rd_req() Buffer Overflow Vulnerability
- CVE-2000-0391: Buffer overflow in krshd in Kerberos 5 allows remote attackers to gain root privileges.
- OSVDB ID: 4876: Kerberos 5 krshd Overflow
Reported:
May 17, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net