7.2 - RHSA-2005:012

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	Updated krb5 packages fix security vulnerabilities

Informations
Name	RHSA-2005:012	First vendor Publication	2005-01-19
Vendor	RedHat	Last vendor Modification	2005-01-19
Severity (Vendor)	N/A	Revision	01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score	7.2	Attack Range	Local
Cvss Impact Score	10	Attack Complexity	Low
Cvss Expoit Score	3.9	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated Kerberos (krb5) packages that correct buffer overflow and temporary file bugs are now available for Red Hat Enterprise Linux.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, ppc64, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

Kerberos is a networked authentication system that uses a trusted third party (a KDC) to authenticate clients and servers to each other.

A heap based buffer overflow bug was found in the administration library of Kerberos 1.3.5 and earlier. This bug could allow an authenticated remote attacker to execute arbitrary commands on a realm's master Kerberos KDC. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1189 to this issue.

Additionally a temporary file bug was found in the Kerberos krb5-send-pr program. It is possible that an attacker could create a temporary file that would allow an arbitrary file to be overwritten which the victim has write access to. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0971 to this issue.

All users of krb5 should upgrade to these updated packages, which contain backported security patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/):

136304 - CAN-2004-0971 temporary file vulnerabilities in krb5-send-pr script 140066 - CAN-2004-0971 temporary file vulnerabilities in krb5-send-pr script 142902 - CAN-2004-1189 buffer overflow in krb5

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2005-012.html

CAPEC : Common Attack Pattern Enumeration & Classification

Id	Name
CAPEC-100	Overflow Buffers
CAPEC-119	Resource Depletion
CAPEC-123	Buffer Attacks

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-787	Out-of-bounds Write (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10497

Oval ID:	oval:org.mitre.oval:def:10497
Title:	The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
Description:	The krb5-send-pr script in the kerberos5 (krb5) package in Trustix Secure Linux 1.5 through 2.1, and possibly other operating systems, allows local users to overwrite files via a symlink attack on temporary files.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-0971	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3	Product(s):
Definition Synopsis:
RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-38 AND krb5 is earlier than 0:1.2.7-38 AND krb5-libs is earlier than 0:1.2.7-38 AND krb5-server is earlier than 0:1.2.7-38 AND krb5-devel is earlier than 0:1.2.7-38

Definition Id: oval:org.mitre.oval:def:11911

Oval ID:	oval:org.mitre.oval:def:11911
Title:	The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
Description:	The add_to_history function in svr_principal.c in libkadm5srv for MIT Kerberos 5 (krb5) up to 1.3.5, when performing a password change, does not properly track the password policy's history count and the maximum number of keys, which can cause an array index out-of-bounds error and may allow authenticated users to execute arbitrary code via a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2004-1189	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-38 AND krb5 is earlier than 0:1.2.7-38 AND krb5-libs is earlier than 0:1.2.7-38 AND krb5-server is earlier than 0:1.2.7-38 AND krb5-devel is earlier than 0:1.2.7-38 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section krb5-workstation is earlier than 0:1.3.4-10 AND krb5 is earlier than 0:1.3.4-10 AND krb5-libs is earlier than 0:1.3.4-10 AND krb5-server is earlier than 0:1.3.4-10 AND krb5-devel is earlier than 0:1.3.4-10

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mit Kerberos 5 cpe:2.3:a:mit:kerberos_5:1.3.5:::::::* cpe:2.3:a:mit:kerberos_5:1.3.4:::::::* cpe:2.3:a:mit:kerberos_5:1.3.3:::::::* cpe:2.3:a:mit:kerberos_5:1.3.2:::::::* cpe:2.3:a:mit:kerberos_5:1.3.1:::::::* cpe:2.3:a:mit:kerberos_5:1.3:alpha1:::::: cpe:2.3:a:mit:kerberos_5:1.3:-:::::: cpe:2.3:a:mit:kerberos_5:1.2.8:::::::* cpe:2.3:a:mit:kerberos_5:1.2.7:::::::* cpe:2.3:a:mit:kerberos_5:1.2.6:::::::* cpe:2.3:a:mit:kerberos_5:1.2.5:::::::* cpe:2.3:a:mit:kerberos_5:1.2.4:::::::* cpe:2.3:a:mit:kerberos_5:1.2.3:::::::* cpe:2.3:a:mit:kerberos_5:1.2.2:::::::* cpe:2.3:a:mit:kerberos_5:1.2.1:::::::* cpe:2.3:a:mit:kerberos_5:1.2:beta2:::::: cpe:2.3:a:mit:kerberos_5:1.2:beta1:::::: cpe:2.3:a:mit:kerberos_5:1.2:-:::::: cpe:2.3:a:mit:kerberos_5:1.1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.0.6:::::::* cpe:2.3:a:mit:kerberos_5:1.0:-:::::: cpe:2.3:a:mit:kerberos_5:::::::: cpe:2.3:a:mit:kerberos_5:-:::::::*	24

OpenVAS Exploits

Date	Description
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200410-24 (mit-krb5) File : nvt/glsa_200410_24.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200501-05 (mit-krb5) File : nvt/glsa_200501_05.nasl
2008-09-04	Name : FreeBSD Ports: krb5, krb5-beta File : nvt/freebsd_krb5.nasl
2008-01-17	Name : Debian Security Advisory DSA 629-1 (krb5) File : nvt/deb_629_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
12533	MIT Kerberos 5 libkadm5srv Password History Handling Overflow
11117	MIT Kerberos 5 send-pr.sh Symlink Arbitrary File Manipulation MIT Kerberos contains a flaw that may allow a malicious user to overwrite arbitrary files on the system with the permissions of the user running Kerberos, which is potentially root. The issue is due to the program creating world-writeagble symlinks with predictable filenames -- users may overwrite those links to point to any file on the filesystem. This may allow files to be overwritten with the contents of the newly created target, resulting in a loss of integrity.

Description

12533

MIT Kerberos 5 libkadm5srv Password History Handling Overflow

11117

MIT Kerberos 5 send-pr.sh Symlink Arbitrary File Manipulation

MIT Kerberos contains a flaw that may allow a malicious user to overwrite arbitrary files on the system with the permissions of the user running Kerberos, which is potentially root. The issue is due to the program creating world-writeagble symlinks with predictable filenames -- users may overwrite those links to point to any file on the filesystem. This may allow files to be overwritten with the contents of the newly created target, resulting in a loss of integrity.

Nessus® Vulnerability Scanner

Date	Description
2006-01-15	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-58-1.nasl - Type : ACT_GATHER_INFO
2005-08-18	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2005-007.nasl - Type : ACT_GATHER_INFO
2005-07-13	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_0bb7677d52f311d9a9e70001020eed82.nasl - Type : ACT_GATHER_INFO
2005-02-22	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-045.nasl - Type : ACT_GATHER_INFO
2005-02-14	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200501-05.nasl - Type : ACT_GATHER_INFO
2005-01-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2005-012.nasl - Type : ACT_GATHER_INFO
2005-01-07	Name : The remote Debian host is missing a security-related update. File : debian_DSA-629.nasl - Type : ACT_GATHER_INFO
2004-12-23	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-563.nasl - Type : ACT_GATHER_INFO
2004-12-23	Name : The remote Fedora Core host is missing a security update. File : fedora_2004-564.nasl - Type : ACT_GATHER_INFO
2004-12-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2004-156.nasl - Type : ACT_GATHER_INFO
2004-10-25	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200410-24.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:48:51	Multiple Updates

Global Informations

Type	Count
Capec ID(s)	3
CWE ID(s)	2
Oval ID(s)	2
CPE ID(s)	24
osvdb(s)	2
Openvas Exploit(s)	5
Nessus® Exploit(s)	11

	Related
7.2	CVE-2004-1189
2.1	CVE-2004-0971
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)