Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 363507 (CVE-2011-0285)

Summary: <app-crypt/mit-krb5-1.8.3-r5: kadmind invalid pointer free() (CVE-2011-0285)
Product: Gentoo Security Reporter: Kevan Carstensen <kacarstensen>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: critical CC: alexanderyt, henson, kerberos
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt
Whiteboard: B1 [glsa]
Package list:
Runtime testing required: ---

Description Kevan Carstensen 2011-04-13 19:14:32 UTC
MITKRB5-SA-2011-004

MIT krb5 Security Advisory 2011-004
Original release: 2011-04-12
Last update: 2011-04-12

Topic: kadmind invalid pointer free()

CVE-2011-0285

CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C

CVSSv2 Base Score:      10

Access Vector:          Network
Access Complexity:      Low
Authentication:         None
Confidentiality Impact: Complete
Integrity Impact:       Complete
Availability Impact:    Complete

CVSSv2 Temporal Score:  7.8

Exploitability:         Proof-of-Concept
Remediation Level:      Official Fix
Report Confidence:      Confirmed

SUMMARY
=======

The password-changing capability of the MIT krb5 administration daemon
(kadmind) has a bug that can cause it to attempt to free() an invalid
pointer under certain error conditions.  This can cause the daemon to
crash or induce the execution of arbitrary code (which is believed to
be difficult).  No exploit that executes arbitrary code is known to
exist, but it is easy to trigger a denial of service manually.

IMPACT
======

An unauthenticated remote attacker can cause the kadmind to terminate,
resulting in a denial of service.  The attacker might be able to
remotely execute code on the host running kadmind, but exploiting the
freeing of an invalid pointer to execute arbitrary code is believed to
be difficult.

Some platforms detect attempted freeing of invalid pointers and
protectively terminate the process, preventing arbitrary code
execution on those platforms.

AFFECTED SOFTWARE
=================

* kadmind in MIT releases krb5-1.7 and later is vulnerable.  Earlier
  releases do not contain the functionality that the vulnerable code
  implements.

FIXES
=====

* Workaround: restart the kadmind when it crashes, possibly using an
  automated monitoring process.

* Upcoming releases in the krb5-1.7.x, krb5-1.8.x, and krb5-1.9.x
  series will contain fixes.

* For the krb5-1.9 release, apply the following patch:

diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index 1124445..0056885 100644
- --- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -52,6 +52,7 @@ process_chpw_request(context, server_handle, realm, keytab,
 
     ret = 0;
     rep->length = 0;
+    rep->data = NULL;
 
     auth_context = NULL;
     changepw = NULL;
@@ -76,8 +77,13 @@ process_chpw_request(context, server_handle, realm, keytab,
     plen = (*ptr++ & 0xff);
     plen = (plen<<8) | (*ptr++ & 0xff);
 
- -    if (plen != req->length)
- -        return(KRB5KRB_AP_ERR_MODIFIED);
+    if (plen != req->length) {
+        ret = KRB5KRB_AP_ERR_MODIFIED;
+        numresult = KRB5_KPASSWD_MALFORMED;
+        strlcpy(strresult, "Request length was inconsistent",
+                sizeof(strresult));
+        goto chpwfail;
+    }
 
     /* verify version number */
 
@@ -531,6 +537,10 @@ cleanup:
     if (local_kaddrs != NULL)
         krb5_free_addresses(server_handle->context, local_kaddrs);
 
+    if ((*response)->data == NULL) {
+        free(*response);
+        *response = NULL;
+    }
     krb5_kt_close(server_handle->context, kt);
 
     return ret;


  This patch is also available at

  http://web.mit.edu/kerberos/advisories/2011-004-patch.txt

  A PGP-signed patch is available at

  http://web.mit.edu/kerberos/advisories/2011-004-patch.txt.asc

* For the krb5-1.8.x releases, the patch is available at

  http://web.mit.edu/kerberos/advisories/2011-004-patch-r18.txt

  A PGP-signed patch is available at

  http://web.mit.edu/kerberos/advisories/2011-004-patch-r18.txt.asc

* For the krb5-1.7.x releases, use the patch for the krb5-1.8.x
  releases, but apply ignoring whitespace differences ("patch -l").

REFERENCES
==========

This announcement is posted at:

  http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt

This announcement and related security advisories may be found on the
MIT Kerberos security advisory page at:

        http://web.mit.edu/kerberos/advisories/index.html

The main MIT Kerberos web page is at:

        http://web.mit.edu/kerberos/index.html

CVSSv2:

    http://www.first.org/cvss/cvss-guide.html
    http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2

CVE: CVE-2011-0285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0285

http://krbdev.mit.edu/rt/Ticket/Display.html?id=6899
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621726

ACKNOWLEDGMENTS
===============

This bug was initially reported to Debian by Felipe Ortega.

CONTACT
=======

The MIT Kerberos Team security contact address is
<krbcore-security@mit.edu>.  When sending sensitive information,
please PGP-encrypt it using the following key:

pub   2048R/56CD8F76 2010-12-29 [expires: 2012-02-01]
uid     MIT Kerberos Team Security Contact <krbcore-security@mit.edu>

DETAILS
=======

The dispatch() function in kadmin/server/schpw.c (which handles the
password changing protocol) allocates an uninitialized krb5_data
structure for the response packet, expecting process_chpw_request() to
fill it in.  There is remotely-inducible error one path through
process_chpw_request() that can return to dispatch() without
initializing the data pointer in the krb5_data structure that is to
hold the response packet, which will cause process_tcp_connection() in
lib/app-utils/net-server.c to free() an invalid pointer (via
kill_tcp_or_rpc_connection()).  Password change requests that arrive
via UDP will not cause kadmind to free() an invalid pointer.

Releases krb5-1.7 and krb5-1.8 put some of the above-mentioned
functions in different source files, but the execution flow is largely
identical.  Releases prior to krb5-1.7 did not have the TCP kpasswd
capability, and are not vulnerable.

REVISION HISTORY
================

2011-04-12      original release

Copyright (C) 2011 Massachusetts Institute of Technology


Reproducible: Didn't try
Comment 1 Eray Aslan gentoo-dev 2011-04-14 06:40:37 UTC
+*mit-krb5-1.9-r3 (14 Apr 2011)
+*mit-krb5-1.8.3-r5 (14 Apr 2011)
+
+  14 Apr 2011; Eray Aslan <eras@gentoo.org> +mit-krb5-1.8.3-r5.ebuild,
+  +files/mit-krb5-1.8.3-CVE-2011-0285.patch, +mit-krb5-1.9-r3.ebuild,
+  +files/CVE-2011-0285.patch:
+  security bump - bug 363507
+

@security
=mit-krb5-1.8.3-r5 should be stabilized.  Thank you.
Comment 2 Tim Sammut (RETIRED) gentoo-dev 2011-04-14 13:50:38 UTC
(In reply to comment #1)
> 
> @security
> =mit-krb5-1.8.3-r5 should be stabilized.  Thank you.

Great, thanks.

Arches, please test and mark stable:
=app-crypt/mit-krb5-1.8.3-r5
Target keywords : "alpha amd64 arm hppa ia64 m68k ppc ppc64 s390 sh sparc x86"
Comment 3 Jeroen Roovers (RETIRED) gentoo-dev 2011-04-14 16:08:07 UTC
Stable for HPPA.
Comment 4 Agostino Sarubbo gentoo-dev 2011-04-14 18:00:04 UTC
amd64 ok
Comment 5 Paweł Hajdan, Jr. (RETIRED) gentoo-dev 2011-04-15 07:22:23 UTC
x86 stable
Comment 6 Christoph Mende (RETIRED) gentoo-dev 2011-04-15 21:40:23 UTC
amd64 stable
Comment 7 Raúl Porcel (RETIRED) gentoo-dev 2011-04-22 18:15:59 UTC
alpha/arm/ia64/m68k/s390/sh/sparc stable
Comment 8 Kacper Kowalik (Xarthisius) (RETIRED) gentoo-dev 2011-04-26 12:14:12 UTC
ppc/ppc64 stable, last arch done
Comment 9 Tim Sammut (RETIRED) gentoo-dev 2011-04-26 13:54:41 UTC
Thanks, folks. Added to existing GLSA request.
Comment 10 GLSAMaker/CVETool Bot gentoo-dev 2012-01-23 20:38:50 UTC
This issue was resolved and addressed in
 GLSA 201201-13 at http://security.gentoo.org/glsa/glsa-201201-13.xml
by GLSA coordinator Sean Amoss (ackle).