RHSA-2003:052 - Security Advisory

Topic

Updated kerberos packages fix a number of vulnerabilities found in MIT
Kerberos.

Description

Kerberos is a network authentication system. The MIT Kerberos team
released an advisory describing a number of vulnerabilities that affect the
kerberos packages shipped by Red Hat.

An integer signedness error in the ASN.1 decoder before version 1.2.5
allows remote attackers to cause a denial of service via a large unsigned
data element length, which is later used as a negative value. The Common
Vulnerabilities and Exposures project has assigned the name CAN-2002-0036
to this issue.

The Key Distribution Center (KDC) before version 1.2.5 allows remote,
authenticated, attackers to cause a denial of service (crash) on KDCs
within the same realm via a certain protocol request that:

• causes a null pointer dereference (CAN-2003-0058).
• causes the KDC to corrupt its heap (CAN-2003-0082).

A vulnerability in Kerberos before version 1.2.3 allows users from
one realm to impersonate users in other realms that have the same
inter-realm keys (CAN-2003-0059).

The MIT advisory for these issues also mentions format string
vulnerabilities in the logging routines (CAN-2003-0060). Previous versions
of the kerberos packages from Red Hat already contain fixes for this issue.

Vulnerabilities have been found in the implementation of support for
triple-DES keys in the implementation of the Kerberos IV authentication
protocol included in MIT Kerberos (CAN-2003-0139).

Vulnerabilities have been found in the Kerberos IV authentication protocol
which allow an attacker with knowledge of a cross-realm key that is shared
with another realm to impersonate any principal in that realm to any
service in that realm. This vulnerability can only be closed by disabling
cross-realm authentication in Kerberos IV (CAN-2003-0138).

Vulnerabilities have been found in the RPC library used by the kadmin
service in Kerberos 5. A faulty length check in the RPC library exposes
kadmind to an integer overflow which can be used to crash kadmind
(CAN-2003-0028).

All users of Kerberos are advised to upgrade to these errata packages,
which disable cross-realm authentication by default for Kerberos IV and
which contain backported patches to correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Please note that this update is available via Red Hat Network. To use Red
Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 2 ia64
• Red Hat Enterprise Linux Server 2 i386
• Red Hat Enterprise Linux Workstation 2 ia64
• Red Hat Enterprise Linux Workstation 2 i386

Fixes

• BZ - 83616 - Multiple kerberos vulnerabilities

CVEs

• CVE-2004-0772
• CVE-2003-0139
• CVE-2003-0138
• CVE-2003-0082
• CVE-2003-0072
• CVE-2003-0028
• CVE-2003-0059
• CVE-2003-0058
• CVE-2002-0036

References

(none)