| Description: | Description:
The remote host is missing updates announced in
advisory CLA-2004:860.
The krb5 packages are MIT's[1] implementation of the Kerberos 5
authentication protocol.
This announcement fixes several vulnerabilities listed in the
advisories MITKRB5-SA-2004-001[2], MITKRB5-SA-2004-002[3] and
MITKRB5-SA-2004-003[4]:
1. Buffer overflows in krb5_aname_to_localname() (CVE-2004-0523[5])
The krb5_aname_to_localname() library function contains multiple
buffer overflows vulnerabilities[5] which could be exploited to gain
unauthorized root access. Exploitation of these flaws requires an
unusual combination of factors, including successful authentication
to a vulnerable service and a non-default configuration on the target
service. This announcement updates the correction used to the patch
provided by Bill Dodd.
2. Several double-free vulnerabilities in KDC and libraries
(CVE-2004-0642[6], CVE-2004-0643[7], CVE-2004-0772[8])
The MIT Kerberos 5 implementation's Key Distribution Center (KDC)
program contains a double-free vulnerability that potentially allows
a remote attacker to execute arbitrary code. Additionally,
double-free vulnerabilities exist in MIT Kerberos 5 library code,
making client programs and application servers vulnerable. The
vulnerability in krb524d was discovered by Marc Horowitz
the other
double-free vulnerabilities were discovered by Will Fiveash and Nico
Williams
at Sun.
3. ASN.1 decoder denial of service (CVE-2004-0644[9])
Will Fiveash and Nico Williams also found a denial-of-service
vulnerability[9] in the ASN.1 decoder library in the MIT Kerberos 5
distribution which could lead to an infinite loop in the decoder,
allowing an unauthenticated remote attacker to cause a KDC or
application server to hang inside an infinite loop and an attacker
impersonating a legitimate KDC or application server to cause a
client program to hang inside an infinite loop.
Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
http://web.mit.edu/Kerberos/www/index.html
http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2004-001-an_to_ln.txt
http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2004-002-dblfree.txt
http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2004-003-asn1.txt
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0523
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0642
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0643
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0772
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0644
http://www.securityspace.com/smysecure/catid.html?in=CLA-2004:860
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002004
Risk factor : Critical
CVSS Score:
10.0
|
