Bugzilla Bug 171889

CVE-2007-0957:

A buffer overflow exists in the krb5_klog_syslog() function used by
kadmind and the KDC.

An authenticated user may be able to execute arbitrary code on a host
running kadmind.

An authenticated user may be able to execute arbitrary code on KDC
host.  Also, a user controlling a Kerberos realm sharing a key with
the target realm may be able to execute arbitrary code on a KDC host.

Successful exploitation can compromise the Kerberos key database and
host security on the host running these programs.  (kadmind and the
KDC typically run as root.)  Unsuccessful exploitation attempts will
likely result in the affected program crashing.

Third-party applications calling krb5_klog_syslog() may also be
vulnerable.

This affects all releases of MIT krb5 up to and including krb5-1.6.

CVE-2007-0956:

A remotely-exploitable root vulnerability is present in an application
which ships in the krb5 sources.

This affects all releases of MIT krb5 up to and including krb5-1.6.

CVE-2007-1216:

An authenticated user may be able to execute arbitrary code on a host
running kadmind.

Successful exploitation can compromise the Kerberos key database and
host security on the host running these programs.  (kadmind and the
KDC typically run as root.)  Unsuccessful exploitation attempts will
likely result in the affected program crashing.

Third-party applications calling either the RPC library or the GSS-API
library provided with MIT krb5 may be vulnerable.

This vulnerability affects MIT krb5 releases krb5-1.4 up to and
including krb5-1.6.  It can affect third-party on all MIT krb5
releases, including krb5-1.6.

Seemant please attach updated ebuilds for pretesting. Do not commit anything to
Portage yet.

I didn't see what the "fix" is here and am curious, as I would like to
*quietly* add a fix for this to the snapshot for the release.  We're planning
on releasing before this date, and GRP does include kerberos support, but we
likely will only be releasing 1 day before, meaning if I can slip in a patch
without a revision bump into the current stable (in my snapshot only), nobody
would be the wiser.  We would have a secure out-of-box release, yet the
"upgrade" would still be the next day.

Is that possible/doable?

Chris, yes, I'll send you an ebuild

Seemant could you attach the ebuilds here as well so I can call arch security
liaisons?

Chris I'm awaiting answer from upstream. I'll update this as soon as I know
more.

Answer received from upstream. Forwarded to Chris.

Seement could you please attach the updated ebuilds, the deadline is getting
close?

Created an attachment (id=114842) [edit]
new ebuild

This is the new proposed ebuild (though I reckon for final release the version
will change).

Created an attachment (id=114843) [edit]
The first patch to fix telnetd

Created an attachment (id=114844) [edit]
The second patch to fix syslogging

Created an attachment (id=114845) [edit]
The third and final patch

OK, here's the ebuild with 3 patches.  Please put the patches into FILESDIR.

Still 1.5.2, correct?

Thx Seemant.

Arch Security Liaisons please test and report back on this bug. Do NOT commit
anything at this time.

OK.  I've added this as 1.5.2 (not -r1) into the snapshot.  While this will go
public before the release date, this just makes it simpler on me since anything
official that goes into the tree will definitely supersede the snapshot's
version.

Thanks everyone!

compiles and works on ppc64.

looks good on ppc

Looks ok on sparc.

Looks good on hppa.

Coordinated release in about 48 hours. Status so far is that we are ready for
the following arches:

hppa ppc ppc64 sparc

We still need OK from the following arches:

x86 amd64 alpha

Security please review the drafted GLSA. 

looks good on x86 

adding kingtaco for amd64

alpha and ia64 looks good.

Removing tcort since he's retired.

patches and compiles on amd64.

nice

public now, advisories availably on MIT site and bugtraq

seemant, please commit the updated ebuild (directly to stable for the tested
arches)

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-003.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-002-syslog.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-001-telnetd.txt

arm (and mips?) should be added as soon as the ebuild has been commited

updating status, since we should of course wait for the ebuild ;-)

thanks for the fast commit seemant

removing arch team members, adding missing arches

ready for GLSA publication

Thx everyone!

GLSA 200704-02

*** Bug 173299 has been marked as a duplicate of this bug. ***