MIT Kerberos 5 Multiple Vulnerabilities Advisory (CVE-2008-0062/0063/0947) and Patch

Critical Vulnerability Information Vulnerability Name: MIT Kerberos 5: Multiple vulnerabilities GLSA ID: GLSA 200803-31 Release Date: March 24, 2008 Risk Level: High Exploitability: Remote Affected Packages Package Name: app-crypt/mit-krb5 Affected Versions: = 1.6.3-r1 Background MIT Kerberos 5 is a suite of applications implementing the Kerberos network authentication protocol. is the administration daemon for MIT Kerberos 5, and KDC stands for Key Distribution Center. Description Two vulnerabilities were discovered in the Kerberos 4 support within the KDC: one involves an uninitialized global variable for certain incoming message types, leading to null pointer dereference or double-free (CVE-2008-0062), and another involves improper clearing of unused portions of a buffer when generating error messages, causing stack contents to be included in the response (CVE-2008-0063). Jeff Altman discovered a buffer overflow in the RPC library server code used by the server, which is triggered when too many file descriptors are opened (CVE-2008-0947). Venustech AD-LAB discovered multiple vulnerabilities in the GSSAPI library: use of a freed variable in the function (CVE-2007-5901), and a double-free vulnerability in the function (CVE-2007-5971). Impact The first two vulnerabilities could be exploited by remote, unauthenticated attackers to execute arbitrary code within the process running on the host, potentially compromising the Kerberos key database or causing a denial of service. These vulnerabilities are only triggered when Kerberos 4 support is enabled. The RPC-related vulnerability can be exploited by remote, unauthenticated attackers to crash , and may allow execution of arbitrary code with root privileges or cause database corruption. This vulnerability is only triggered in configurations that allow a large number of open file descriptors. The GSSAPI vulnerabilities could be exploited by remote attackers to cause denial of service or potentially execute arbitrary code. Solution All users of MIT Kerberos 5 should upgrade to the latest version: References CVE-2007-5901 CVE-2007-5971 CVE-2008-0062 CVE-2008-0063 CVE-2008-0947

Goal Reached Thanks to every supporter — we hit 100%!

MIT Kerberos 5 Multiple Vulnerabilities Advisory (CVE-2008-0062/0063/0947) and Patch