Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 548026 (CVE-2015-2694)

Summary: <app-crypt/mit-krb5-1.13.2: issues in OTP and PKINIT kdcpreauth modules leading to requires_preauth bypass (CVE-2014-5355,CVE-2015-2694)
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: kerberos
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://bugzilla.redhat.com/show_bug.cgi?id=1216133
Whiteboard: B3 [noglsa/cve]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2015-04-28 15:26:51 UTC
From ${URL} :

In the OTP kdcpreauth module, the TKT_FLG_PRE_AUTH bit was set before the request was successfully 
verified. In the PKINIT kdcpreauth module, code 0 was returned on empty input or an unconfigured 
realm. Together, these bugs could cause the KDC preauth framework to erroneously treat a request as 
pre-authenticated.

In MIT krb5 1.12 and later, when the KDC is configured with PKINIT support, an unauthenticated 
remote attacker can bypass the requires_preauth flag on a client principal and obtain a ciphertext 
encrypted in the principal's long-term key. This ciphertext could be used to conduct an off-line 
dictionary attack against the user's password.

Upstream patch:

https://github.com/krb5/krb5/commit/e3b5a5e5267818c97750b266df50b6a3d4649604


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 GLSAMaker/CVETool Bot gentoo-dev 2015-06-14 20:53:35 UTC
CVE-2015-2694 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2694):
  The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before
  1.13.2 do not properly track whether a client's request has been validated,
  which allows remote attackers to bypass an intended preauthentication
  requirement by providing (1) zero bytes of data or (2) an arbitrary realm
  name, related to plugins/preauth/otp/main.c and
  plugins/preauth/pkinit/pkinit_srv.c.
Comment 2 GLSAMaker/CVETool Bot gentoo-dev 2015-06-20 14:02:56 UTC
CVE-2014-5355 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5355):
  MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a
  krb5_read_message data field is represented as a string ending with a '\0'
  character, which allows remote attackers to (1) cause a denial of service
  (NULL pointer dereference) via a zero-byte version string or (2) cause a
  denial of service (out-of-bounds read) by omitting the '\0' character,
  related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.
Comment 3 GLSAMaker/CVETool Bot gentoo-dev 2015-06-20 14:03:01 UTC
CVE-2014-5355 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-5355):
  MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a
  krb5_read_message data field is represented as a string ending with a '\0'
  character, which allows remote attackers to (1) cause a denial of service
  (NULL pointer dereference) via a zero-byte version string or (2) cause a
  denial of service (out-of-bounds read) by omitting the '\0' character,
  related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.
Comment 4 Sean Amoss (RETIRED) gentoo-dev Security 2015-06-20 14:03:56 UTC
Maintainers, are we ready for stabilization here?
Comment 5 Eray Aslan gentoo-dev 2015-06-23 09:21:11 UTC
Arches, please test and mark stable
=app-crypt/mit-krb5-1.13.2

Target Keywords: alpha amd64 arm hppa ia64 ppc ppc64 sparc x86
Comment 6 Agostino Sarubbo gentoo-dev 2015-06-23 15:19:11 UTC
amd64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2015-06-24 07:58:20 UTC
ppc stable
Comment 8 Jeroen Roovers (RETIRED) gentoo-dev 2015-06-25 06:06:33 UTC
Stable for PPC64.
Comment 9 Jeroen Roovers (RETIRED) gentoo-dev 2015-06-26 05:20:56 UTC
Stable for HPPA.
Comment 10 Agostino Sarubbo gentoo-dev 2015-06-26 08:05:34 UTC
x86 stable
Comment 11 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2015-06-27 12:37:31 UTC
arm stable
Comment 12 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2015-06-28 08:51:11 UTC
ia64 stable
Comment 13 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2015-06-28 17:53:59 UTC
alpha stable
Comment 14 Agostino Sarubbo gentoo-dev 2015-07-23 09:37:11 UTC
sparc stable.

Maintainer(s), please cleanup.
Security, please vote.
Comment 15 Yury German Gentoo Infrastructure gentoo-dev 2015-08-05 06:10:16 UTC
Arches and Maintainer(s), Thank you for your work.

GLSA Vote: No
Comment 16 Kristian Fiskerstrand (RETIRED) gentoo-dev 2015-09-08 06:30:44 UTC
GLSA Vote: No