RHSA-2007:0562

Executive Summary

Summary
Title	krb5 security update

Informations
Name	RHSA-2007:0562	First vendor Publication	2007-06-26
Vendor	RedHat	Last vendor Modification	2007-06-26
Severity (Vendor)	Important	Revision	01

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated krb5 packages that fix several security flaws are now available for
Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other through use of symmetric encryption
and a trusted third party, the KDC. kadmind is the KADM5 administration
server.

David Coffey discovered an uninitialized pointer free flaw in the RPC
library used by kadmind. On Red Hat Enterprise Linux 4 and 5, glibc
detects attempts to free invalid pointers. A remote unauthenticated
attacker who can access kadmind could trigger this flaw and cause kadmind
to crash. (CVE-2007-2442)

David Coffey also discovered an overflow flaw in the RPC library used by
kadmind. On Red Hat Enterprise Linux, exploitation of this flaw is limited
to a denial of service. A remote unauthenticated attacker who can access
kadmind could trigger this flaw and cause kadmind to crash. (CVE-2007-2443)

A stack buffer overflow flaw was found in kadmind. An authenticated
attacker who can access kadmind could trigger this flaw and potentially
execute arbitrary code on the Kerberos server. (CVE-2007-2798)

Users of krb5-server are advised to update to these erratum packages which
contain backported fixes to correct these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

245547 - CVE-2007-2442 krb5 RPC library unitialized pointer free
245548 - CVE-2007-2443 krb5 RPC library stack overflow
245549 - CVE-2007-2798 krb5 kadmind buffer overflow

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2007-0562.html

CAPEC : Common Attack Pattern Enumeration & Classification

id	Name
CAPEC-3	Using Leading 'Ghost' Character Sequences to Bypass Input Filters
CAPEC-7	Blind SQL Injection
CAPEC-8	Buffer Overflow in an API Call
CAPEC-9	Buffer Overflow in Local Command-Line Utilities
CAPEC-10	Buffer Overflow via Environment Variables
CAPEC-13	Subverting Environment Variable Values
CAPEC-14	Client-side Injection-induced Buffer Overflow
CAPEC-18	Embedding Scripts in Nonscript Elements
CAPEC-22	Exploiting Trust in Client (aka Make the Client Invisible)
CAPEC-24	Filter Failure through Buffer Overflow
CAPEC-28	Fuzzing
CAPEC-31	Accessing/Intercepting/Modifying HTTP Cookies
CAPEC-32	Embedding Scripts in HTTP Query Strings
CAPEC-42	MIME Conversion
CAPEC-43	Exploiting Multiple Input Interpretation Layers
CAPEC-45	Buffer Overflow via Symbolic Links
CAPEC-46	Overflow Variables and Tags
CAPEC-47	Buffer Overflow via Parameter Expansion
CAPEC-52	Embedding NULL Bytes
CAPEC-53	Postfix, Null Terminate, and Backslash
CAPEC-63	Simple Script Injection
CAPEC-64	Using Slashes and URL Encoding Combined to Bypass Validation Logic
CAPEC-66	SQL Injection
CAPEC-67	String Format Overflow in syslog()
CAPEC-71	Using Unicode Encoding to Bypass Validation Logic
CAPEC-72	URL Encoding
CAPEC-73	User-Controlled Filename
CAPEC-78	Using Escaped Slashes in Alternate Encoding
CAPEC-79	Using Slashes in Alternate Encoding
CAPEC-80	Using UTF-8 Encoding to Bypass Validation Logic
CAPEC-81	Web Logs Tampering
CAPEC-83	XPath Injection
CAPEC-85	Client Network Footprinting (using AJAX/XSS)
CAPEC-86	Embedding Script (XSS ) in HTTP Headers
CAPEC-88	OS Command Injection
CAPEC-91	XSS in IMG Tags
CAPEC-99	XML Parser Attack
CAPEC-101	Server Side Include (SSI) Injection
CAPEC-104	Cross Zone Scripting
CAPEC-106	Cross Site Scripting through Log Files
CAPEC-108	Command Line Execution through SQL Injection
CAPEC-109	Object Relational Mapping Injection
CAPEC-110	SQL Injection through SOAP Parameter Tampering
CAPEC-171	Variable Manipulation

CWE : Common Weakness Enumeration

id	Name
CWE-20	Improper Input Validation
CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:7344

Oval ID:	oval:org.mitre.oval:def:7344
Title:	HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code
Description:	The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2442	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41168 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41167 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41166 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than D.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than D.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than D.1.6.2.08 OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests krb5client.KRB5-64SLIB-A version is less than C.1.3.5.10 AND krb5client.KRB5-PRG-A version is less than C.1.3.5.10 AND krb5client.KRB5-RUN-A version is less than C.1.3.5.10 AND krb5client.KRB5-SHLIB-A version is less than C.1.3.5.10 OR Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests krb5client.KRB5-64SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than E.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than E.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than E.1.6.2.08

Definition Id: oval:org.mitre.oval:def:10631

Oval ID:	oval:org.mitre.oval:def:10631
Title:	The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.
Description:	The gssrpc__svcauth_gssapi function in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a zero-length RPC credential, which causes kadmind to free an uninitialized pointer during cleanup.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2442	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-66 AND krb5 is earlier than 0:1.2.7-66 AND krb5-libs is earlier than 0:1.2.7-66 AND krb5-server is earlier than 0:1.2.7-66 AND krb5-devel is earlier than 0:1.2.7-66 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section krb5-workstation is earlier than 0:1.3.4-49 AND krb5 is earlier than 0:1.3.4-49 AND krb5-libs is earlier than 0:1.3.4-49 AND krb5-server is earlier than 0:1.3.4-49 AND krb5-devel is earlier than 0:1.3.4-49 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section krb5-workstation is earlier than 0:1.5-26 AND krb5 is earlier than 0:1.5-26 AND krb5-libs is earlier than 0:1.5-26 AND krb5-server is earlier than 0:1.5-26 AND krb5-devel is earlier than 0:1.5-26

Definition Id: oval:org.mitre.oval:def:7131

Oval ID:	oval:org.mitre.oval:def:7131
Title:	HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code
Description:	Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2443	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41168 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41167 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41166 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than D.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than D.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than D.1.6.2.08 OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests krb5client.KRB5-64SLIB-A version is less than C.1.3.5.10 AND krb5client.KRB5-PRG-A version is less than C.1.3.5.10 AND krb5client.KRB5-RUN-A version is less than C.1.3.5.10 AND krb5client.KRB5-SHLIB-A version is less than C.1.3.5.10 OR Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests krb5client.KRB5-64SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than E.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than E.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than E.1.6.2.08

Definition Id: oval:org.mitre.oval:def:11277

Oval ID:	oval:org.mitre.oval:def:11277
Title:	Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.
Description:	Integer signedness error in the gssrpc__svcauth_unix function in svc_auth_unix.c in the RPC library in MIT Kerberos 5 (krb5) 1.6.1 and earlier might allow remote attackers to execute arbitrary code via a negative length value.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2443	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-66 AND krb5 is earlier than 0:1.2.7-66 AND krb5-libs is earlier than 0:1.2.7-66 AND krb5-server is earlier than 0:1.2.7-66 AND krb5-devel is earlier than 0:1.2.7-66 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section krb5-workstation is earlier than 0:1.3.4-49 AND krb5 is earlier than 0:1.3.4-49 AND krb5-libs is earlier than 0:1.3.4-49 AND krb5-server is earlier than 0:1.3.4-49 AND krb5-devel is earlier than 0:1.3.4-49 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section krb5-workstation is earlier than 0:1.5-26 AND krb5 is earlier than 0:1.5-26 AND krb5-libs is earlier than 0:1.5-26 AND krb5-server is earlier than 0:1.5-26 AND krb5-devel is earlier than 0:1.5-26

Definition Id: oval:org.mitre.oval:def:9996

Oval ID:	oval:org.mitre.oval:def:9996
Title:	Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.
Description:	Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2798	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-66 AND krb5 is earlier than 0:1.2.7-66 AND krb5-libs is earlier than 0:1.2.7-66 AND krb5-server is earlier than 0:1.2.7-66 AND krb5-devel is earlier than 0:1.2.7-66 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section krb5-workstation is earlier than 0:1.3.4-49 AND krb5 is earlier than 0:1.3.4-49 AND krb5-libs is earlier than 0:1.3.4-49 AND krb5-server is earlier than 0:1.3.4-49 AND krb5-devel is earlier than 0:1.3.4-49 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section krb5-workstation is earlier than 0:1.5-26 AND krb5 is earlier than 0:1.5-26 AND krb5-libs is earlier than 0:1.5-26 AND krb5-server is earlier than 0:1.5-26 AND krb5-devel is earlier than 0:1.5-26

Definition Id: oval:org.mitre.oval:def:7550

Oval ID:	oval:org.mitre.oval:def:7550
Title:	HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code
Description:	Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2798	Version:	3
Platform(s):	HP-UX 11	Product(s):
Definition Synopsis:
Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41168 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-64SLIB is installed AND KRB5-Client.KRB5-IA32SLIB is installed AND KRB5-Client.KRB5-IA64SLIB is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41167 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests KRB5-Client.KRB5-SHLIB is installed AND KRB5-Client.KRB5-PRG is installed AND KRB5-Client.KRB5-RUN is installed AND KRB5-Client.KRB5-64SLIB is installed AND NOT Patch PHSS_41166 is installed OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.23 AND filesets tests krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-64SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than D.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than D.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than D.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than D.1.6.2.08 OR Criteria meets HP Security Bulletin HPSBUX02544 HP Release B.11.11 AND filesets tests krb5client.KRB5-64SLIB-A version is less than C.1.3.5.10 AND krb5client.KRB5-PRG-A version is less than C.1.3.5.10 AND krb5client.KRB5-RUN-A version is less than C.1.3.5.10 AND krb5client.KRB5-SHLIB-A version is less than C.1.3.5.10 OR Criteria meets HP Security Bulletin HPSBUX02544 HP-UX B.11.31 AND filesets tests krb5client.KRB5-64SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5-PRG-A version is less than E.1.6.2.08 AND krb5client.KRB5-RUN-A version is less than E.1.6.2.08 AND krb5client.KRB5-SHLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA32SLIB-A version is less than E.1.6.2.08 AND krb5client.KRB5IA64SLIB-A version is less than E.1.6.2.08

Definition Id: oval:org.mitre.oval:def:1726

Oval ID:	oval:org.mitre.oval:def:1726
Title:	Security Vulnerability in the Kerberos Administration Daemon (kadmind(1M)) May Lead to Arbitrary Code Execution
Description:	Stack-based buffer overflow in the rename_principal_2_svc function in kadmind for MIT Kerberos 1.5.3, 1.6.1, and other versions allows remote authenticated users to execute arbitrary code via a crafted request to rename a principal.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-2798	Version:	2
Platform(s):	Sun Solaris 9 Sun Solaris 10	Product(s):
Definition Synopsis:
Solaris 8 (SPARC) meets Sun Alert 102985 Solaris 8 (SPARC) is installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5ma) installed AND Key Distribution Center (kadmind) process running OR Solaris 8 (x86) meets Sun Alert 102985 Solaris 8 (x86) is installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5ma) installed AND Key Distribution Center (kadmind) process running OR Solaris 9 (SPARC) meets Sun Alert 102985 Solaris 9 (SPARC) is installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5ma) installed AND Key Distribution Center (kadmind) process running OR Solaris 9 (x86) meets Sun Alert 102985 Solaris 9 (x86) is installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5ma) installed AND Key Distribution Center (kadmind) process running OR Solaris 10 (SPARC) meets Sun Alert 102985 Solaris 10 (SPARC) is installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5ma) installed AND Key Distribution Center (kadmind) process running OR Solaris 10 (x86) meets Sun Alert 102985 Solaris 10 (x86) is installed AND Sun Enterprise Authentication Mechanism (SEAM, SUNWkr5ma) installed AND Key Distribution Center (kadmind) process running

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mit Kerberos cpe:/a:mit:kerberos:5-1.6.1 cpe:/a:mit:kerberos:5-1.6 cpe:/a:mit:kerberos:5-1.5.3 cpe:/a:mit:kerberos:5-1.5.2 cpe:/a:mit:kerberos:5-1.5.1 cpe:/a:mit:kerberos:5-1.5 cpe:/a:mit:kerberos:5-1.4.4 cpe:/a:mit:kerberos:5-1.4.3 cpe:/a:mit:kerberos:5-1.4.2 cpe:/a:mit:kerberos:5-1.4.1 cpe:/a:mit:kerberos:5-1.4 cpe:/a:mit:kerberos:5-1.3.6 cpe:/a:mit:kerberos:5-1.3.5 cpe:/a:mit:kerberos:5-1.3.4 cpe:/a:mit:kerberos:5-1.3.3 cpe:/a:mit:kerberos:5-1.3.2 cpe:/a:mit:kerberos:5-1.3.1 cpe:/a:mit:kerberos:5-1.3 cpe:/a:mit:kerberos:5-1.3:alpha1 cpe:/a:mit:kerberos:5-1.2.8 cpe:/a:mit:kerberos:5-1.2.7 cpe:/a:mit:kerberos:5-1.2.6 cpe:/a:mit:kerberos:5-1.2.5 cpe:/a:mit:kerberos:5-1.2.4 cpe:/a:mit:kerberos:5-1.2.3 cpe:/a:mit:kerberos:5-1.2.2 cpe:/a:mit:kerberos:5-1.2.1 cpe:/a:mit:kerberos:5-1.2 cpe:/a:mit:kerberos:5-1.1 cpe:/a:mit:kerberos:5	30

Open Source Vulnerability Database (OSVDB)

id	Description
36597	MIT Kerberos 5 RPC Library gssrpc__svcauth_unix Function Remote Code Execution
36596	MIT Kerberos 5 RPC Library gssrpc__svcauth_gssapi Function Remote Code Execution
36595	MIT Kerberos kadmind rename_principal_2_svc Function Remote Overflow