MIT Kerberos e_msg variable buffer overflow
| kerberos-emsg-bo (4658) |  Medium Risk |
Description:
MIT Kerberos is vulnerable to a buffer overflow in the e_msg variable in the kerb_err_reply function that could lead to a denial of service. A remote attacker could overflow this buffer to cause the KDC to issue invalid tickets for all principles, generate a "principal unknown" error, or crash the KDC process. Both Kerberos 4 and Kerberos 5 KDC servers that can service version 4 ticket requests are vulnerable.
Platforms Affected:
- Cygnus, Cygnus KerbNet
- Cygnus, Cygnus Network Security
- MIT, Kerberos 4 patch 10
- MIT, Kerberos 5-1.0
- MIT, Kerberos 5-1.1
- MIT, Kerberos 5-1.1.1
Remedy:
For Kerberos distributions from MIT:
- Upgrade to MIT Kerberos 5 version 1.2 when it becomes available.
For MIT-derived implementations of Kerberos:
- Contact your vendor for upgrade or patch information.
As a workaround, apply the appropriate KDC patch from MIT, as listed in the Kerberos Security Advisory. See References. As an alternative, in Kerberos 5, it may be possible to disable Kerberos 4 authentication by supplying command line options, as described in the manpages or other documentation for your Kerberos distribution.
Consequences:
Denial of Service
References:
- BugTraq Mailing List, Fri Jun 09 2000 - 14:08:59 CDT, Security Advisory: MULTIPLE DENIAL OF SERVICE VULNERABILITIES IN KRB4 KDC at http://archives.neohapsis.com/archives/bugtraq/2000-06/0064.html.
- CERT Advisory CA-1992-13, MIT Kerberos Vulnerable to Denial-of-Service Attacks at http://www.cert.org/advisories/CA-2000-11.html.
- CIAC Information Bulletin K-051, Denial of Service Vulnerabilities in Kerberos 4 KDC Programs at http://ciac.llnl.gov/ciac/bulletins/k-051.shtml.
- Kerberos Security Advisory, MULTIPLE DENIAL OF SERVICE VULNERABILITIES IN KRB4 KDC at http://web.mit.edu/kerberos/www/advisories/krb4kdc.txt.
- CVE-2000-0548: Buffer overflow in Kerberos 4 KDC program allows remote attackers to cause a denial of service via the e_msg variable in the kerb_err_reply function.
- OSVDB ID: 4875: Kerberos e_msg Variable Buffer Overflow
Reported:
Jun 09, 2000
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net