----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
Kerberos V5 Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA16041

VERIFY ADVISORY:
http://secunia.com/advisories/16041/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
Kerberos V5
http://secunia.com/product/556/

DESCRIPTION:
Some vulnerabilities have been reported in Kerberos, which can be
exploited by malicious people to cause a DoS (Denial of Service) or
potentially compromise a vulnerable system.

1) A double-free error in the "krb5_recvauth()" function can
potentially be exploited to execute arbitrary code in the context of
the program calling this function. 

Successful exploitation may lead to the compromise of an entire
Kerberos realm or cause the program to crash.

The vulnerability has been reported in kpropd, klogind, and krshd
versions 1.4.1 and prior. Any third-party programs calling the
"krb5_recvauth()" function are also vulnerable.

2) An error in the Key Distribution Center (KDC) implementation
causes the freeing of memory at random locations, which leads to heap
corruption via a specially crafted TCP request.

Successful exploitation crashes the KDC.

The vulnerability has been reported in KDC implementations versions
1.4.1 and prior.

3) A boundary error in the KDC can cause a single-byte heap-based
buffer overflow via a specially crafted TCP or UDP request. This can
potentially be exploited to execute arbitrary code.

Successful exploitation may lead to the compromise of an entire
Kerberos realm or cause a DoS.

The vulnerability has been reported in KDC implementations and
application servers versions 1.4.1 and prior. Third-party application
servers using MIT krb5 are also affected.

SOLUTION:
Apply patches:
http://web.mit.edu/kerberos/advisories/2005-003-patch_1.4.1.txt
http://web.mit.edu/kerberos/advisories/2005-002-patch_1.4.1.txt

The vulnerabilities will also be fixed in version 1.4.2.

PROVIDED AND/OR DISCOVERED BY:
1) The vendor credits Magnus Hagander.
2, 3) The vendor credits Daniel Wachdorf.

ORIGINAL ADVISORY:
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-003-recvauth.txt
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-002-kdc.txt

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------