From ${URL} : This flaw has commonly been referred to as CVE-1999-0103 because that CVE also describes a UDP ping-pong attack. The same type of issue exists in kadmind's kpasswd handling, but unfortunately no one told upstream for the last decade. CVE-1999-0103 never mentioned krb5 in any way other than with regards to a Nessus plugin that tests for the CVE-1999-0103 weakness in kpasswd handling. Upstream now knows and a fix is available. Cut-n-paste from our bug report follows: A flaw in certain programs that handle UDP traffic was discovered and assigned the name CVE-1999-0103 (that CVE specifically mentions echo and chargen as vulnerable). In 2002, a Nessus plugin was included [1] that reference this CVE name, but was for the kpasswd service. Until recently, this issue had not been reported upstream. This issue has since been reported upstream [2] and is now fixed [3]. If a malicious remote user were to spoof their IP address to that of another server running kadmind with the password change port (kpasswd, port 464), or to the target server's IP address itself), kpasswd will pass UDP packets to the spoofed address and reply each time. This can be used to consume bandwidth and CPU on the affected servers running kadmind. This should be fixed in the for krb5-1.11.3 release. [1] http://marc.info/?l=nessus&m=102418951803893&w=2 [2] http://krbdev.mit.edu/rt/Ticket/Display.html?id=7637 [3] https://github.com/krb5/krb5/commit/cf1a0c411b2668c57c41e9c4efd15ba17b6b322c After discussing with upstream and MITRE, it was decided that this issue needed its own CVE name, so it was assigned CVE-2002-2443. @maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
+*mit-krb5-1.11.2-r1 (14 May 2013) + + 14 May 2013; Eray Aslan <eras@gentoo.org> +files/CVE-2002-2443.patch, + +mit-krb5-1.11.2-r1.ebuild: + Security bump - bug #469752 + @security: We can stabilize =app-crypt/mit-krb5-1.11.2-r1. Thank you.
All right, let's stabilize. Arches, please stabilize =app-crypt/mit-krb5-1.11.3, target arches: alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86. Thanks!
amd64 stable
x86 stable
ppc stable
Stable for HPPA.
ppc64 stable
alpha stable
arm stable
ia64 stable
sh stable
sparc stable
s390 stable
Thanks for your work GLSA vote: yes
GLSA vote: yes, added to GLSA.
CVE-2002-2443 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2002-2443): schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.
This issue was resolved and addressed in GLSA 201312-12 at http://security.gentoo.org/glsa/glsa-201312-12.xml by GLSA coordinator Sergey Popov (pinkbyte).
