----------------------------------------------------------------------

Secunia customers receive relevant and filtered advisories.
Delivery is done via different channels including SMS, Email, Web,
and https based XML feed.
http://corporate.secunia.com/trial/38/request/

----------------------------------------------------------------------

TITLE:
Kerberos Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA24740

VERIFY ADVISORY:
http://secunia.com/advisories/24740/

CRITICAL:
Moderately critical

IMPACT:
Security Bypass, DoS, System access

WHERE:
>From remote

SOFTWARE:
Kerberos 5.x
http://secunia.com/product/556/

DESCRIPTION:
Some vulnerabilities have been reported in Kerberos, which can be
exploited by malicious users to cause a DoS or compromise a
vulnerable system and by malicious people to bypass certain security
restrictions.

1) An error exists in the MIT krb5 telnet daemon (telnetd) when
processing the username. This can be exploited to log in as an
arbitrary user by providing a specially crafted username beginning
with "-e".

NOTE: If the telnet daemon is configured to only permit authenticated
login, only authenticated users can exploit this vulnerability.

2) A boundary error exists in the "krb5_klog_syslog()" function
within the kadm5 library, which is used by KDC, kadmind and probably
other third party products. This can be exploited to cause a
stack-based buffer overflow via an overly long string.

Successful exploitation allows execution of arbitrary code, but
requires valid credentials.

3) A double-free error exists in the "kg_unseal_v1()" function within
the MIT krb5 GSS-API library, which is used by kadmind and probably
other third-party products. This can potentially be exploited to
execute arbitrary code, but requires valid credentials.

The vulnerabilities are reported in version krb5-1.6. Other versions
may also be affected.

SOLUTION:
Apply patches (see vendor advisories for details).

http://web.mit.edu/kerberos/advisories/2007-001-patch.txt
http://web.mit.edu/kerberos/advisories/2007-001-patch.txt.asc

http://web.mit.edu/kerberos/advisories/2007-002-patch.txt
http://web.mit.edu/kerberos/advisories/2007-002-patch.txt.asc

http://web.mit.edu/kerberos/advisories/2007-003-patch.txt
http://web.mit.edu/kerberos/advisories/2007-003-patch.txt.asc

PROVIDED AND/OR DISCOVERED BY:
1, 3) Reported by the vendor
2) An anonymous person, reported via iDefense Labs

ORIGINAL ADVISORY:
Kerberos:
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-001-telnetd.txt
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-002-syslog.txt
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-003.txt

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=500

OTHER REFERENCES:
US-CERT VU#220816:
http://www.kb.cert.org/vuls/id/220816

US-CERT VU#704024:
http://www.kb.cert.org/vuls/id/704024

US-CERT VU#419344:
http://www.kb.cert.org/vuls/id/419344

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------