Executive Summary

Summary
Title New krb4 packages fix buffer overflow
Informations
Name DSA-184 First vendor Publication 2002-10-30
Vendor Debian Last vendor Modification 2002-10-30
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Tom Yu and Sam Hartman of MIT discovered another stack buffer overflow in the kadm_ser_wrap_in function in the Kerberos v4 administration server. This kadmind bug has a working exploit code circulating, hence it is considered serious.

This problem has been fixed in version 1.1-8-2.2 for the current stable distribution (woody), in version 1.0-2.2 for the old stable distribution (potato) and in version 1.1-11-8 for the unstable distribution (sid).

We recommend that you upgrade your krb4 packages immediately.

wget url will fetch the file for you dpkg -i file.deb will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update will update the internal database apt-get upgrade will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 2.2 alias potato

Original Source

Url : http://www.debian.org/security/2002/dsa-184

CAPEC : Common Attack Pattern Enumeration & Classification

Id Name
CAPEC-47 Buffer Overflow via Parameter Expansion

CWE : Common Weakness Enumeration

% Id Name

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Application 15
Os 1

OpenVAS Exploits

Date Description
2008-01-17 Name : Debian Security Advisory DSA 183-1 (krb5)
File : nvt/deb_183_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 184-1 (krb4)
File : nvt/deb_184_1.nasl
2008-01-17 Name : Debian Security Advisory DSA 185-1 (heimdal)
File : nvt/deb_185_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
5618 Heimdal Kerberos kf / kfd Multiple Buffer Overflows

Multiple remote overflows exist in Heimdal Kerberos. The 'kf' binary and the 'kfd' daemon fail to perform proper bounds checking resulting in multiple buffer overflows. With a specially crafted request, a remote attacker can cause arbitrary code execution resulting in a loss of integrity.
4900 Heimdal Kerberos kadmind Forwarding Daemon Overflow

Heimdal Kerberos contains a flaw that may allow a malicious user to exploit a buffer overflow condition. The issue is triggered because Heimdal does not properly verify the length field of a request to the Kerberos forwarding daemon. It is possible that the flaw may allow remote attackers to execute arbitrary code resulting in a loss of confidentiality, integrity, and/or availability.
4870 Multiple Kerberos Compatibility Administration Daemon Overflow

A remote overflow exists in several implementations of Kerberos 4 and legacy compatibility for Kerberos 4 in kerberos 5 distributions. The kadmind daemon fails to do proper bounds checking, resulting in a stack overflow. With a specially crafted request, an attacker can cause the daemon to execute arbitrary commands on the server, resulting in a loss of integrity.

Snort® IPS/IDS

Date Description
2014-01-10 successful kadmind buffer overflow attempt
RuleID : 1901-community - Revision : 16 - Type : SERVER-OTHER
2014-01-10 successful kadmind buffer overflow attempt
RuleID : 1901 - Revision : 16 - Type : SERVER-OTHER
2014-01-10 successful kadmind buffer overflow attempt
RuleID : 1900-community - Revision : 15 - Type : SERVER-OTHER
2014-01-10 successful kadmind buffer overflow attempt
RuleID : 1900 - Revision : 15 - Type : SERVER-OTHER
2014-01-10 kadmind buffer overflow attempt
RuleID : 1899-community - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1899 - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1898-community - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1898 - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1897-community - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1897 - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1896-community - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1896 - Revision : 12 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1895-community - Revision : 13 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1895 - Revision : 13 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1894-community - Revision : 14 - Type : INDICATOR-SHELLCODE
2014-01-10 kadmind buffer overflow attempt
RuleID : 1894 - Revision : 14 - Type : INDICATOR-SHELLCODE

Nessus® Vulnerability Scanner

Date Description
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-178.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-183.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-184.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-185.nasl - Type : ACT_GATHER_INFO
2004-07-31 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2002-073.nasl - Type : ACT_GATHER_INFO
2004-07-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2002-250.nasl - Type : ACT_GATHER_INFO
2004-07-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2003-021.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:28:38
  • Multiple Updates