From: Secunia Security Advisories (sec-advsecunia.com)
Date: Wed Mar 19 2008 - 21:07:04 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Kerberos Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA29428

VERIFY ADVISORY:
http://secunia.com/advisories/29428/

CRITICAL:
Highly critical

IMPACT:
Exposure of sensitive information, DoS, System access

WHERE:
From remote

SOFTWARE:
Kerberos 5.x
http://secunia.com/product/556/

DESCRIPTION:
Some vulnerabilities have been reported in Kerberos, which can be
exploited by malicious people to disclose potentially sensitive
information, cause a DoS (Denial of Service), or potentially
compromise a vulnerable system.

1) The problem is that KDC uses a global variable for all incoming
krb4 requests, but sets the variable only for certain requests. This
can be exploited to crash an affected server, potentially execute
arbitrary code, or disclose potentially sensitive memory.

2) An error exists in KDC when sending responses for krb4 requests.
This can be exploited to disclose potentially sensitive stack memory
via a specially crafted krb4 request.

Successful exploitation of the vulnerabilities requires that krb4
support is enabled in KDC (disabled by default in newer versions).

3) Two errors exist in the Kerberos RPC library when handling open
file descriptors. This can be exploited to cause a memory corruption
via an overly large number of RPC connections.

Successful exploitation of the vulnerability may allow execution of
arbitrary code, but requires that the operating system allows an
overly large number of opened file descriptors, and that "FD_SETSIZE"
is not defined in the system headers for versions prior to 1.3.

Vulnerabilities #1 and #2 are reported in Kerberos 5 versions 1.6.3
and prior. Vulnerability #3 is reported in Kerberos 5 versions 1.2.2
through 1.3, and versions 1.4 through 1.6.3.

SOLUTION:
Apply vendor patches.
http://web.mit.edu/kerberos/advisories/2008-001-patch.txt
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2008-002.txt

PROVIDED AND/OR DISCOVERED BY:
1) Reported by the vendor.
2) The vendor credits Jeff Altman of Secure Endpoints, and Red Hat
Security Response Team.

ORIGINAL ADVISORY:
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2008-001.txt
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2008-002.txt

OTHER REFERENCES:
US-CERT VU#895609:
http://www.kb.cert.org/vuls/id/895609

US-CERT VU#374121:
http://www.kb.cert.org/vuls/id/374121

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/

Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]