MIT Kerberos 5 Administration Library Add_To_History Heap-Based Buffer Overflow Vulnerability

BID:12059

Info

MIT Kerberos 5 Administration Library Add_To_History Heap-Based Buffer Overflow Vulnerability

Bugtraq ID: 12059
Class: Boundary Condition Error
CVE: CVE-2004-1189
Remote: No
Local: Yes
Published: Dec 20 2004 12:00AM
Updated: Jul 12 2009 09:26AM
Credit: Discovery of this vulnerability is credited Michael Tautschnig.
Vulnerable: Turbolinux Turbolinux Server 10.0
Turbolinux Turbolinux Server 8.0
Turbolinux Turbolinux Desktop 10.0
Turbolinux Home
Turbolinux Appliance Server 1.0 Workgroup Edition
Turbolinux Appliance Server 1.0 Hosting Edition
Sun Solaris 9_x86
Sun Solaris 9
Sun Solaris 8_x86
Sun Solaris 8_sparc
Sun SEAM 1.0.2
+ Sun Solaris 9_x86
 + Sun Solaris 9
 Sun SEAM 1.0.1
+ Sun Solaris 8_x86
 + Sun Solaris 8_sparc
 SGI ProPack 3.0
Redhat Linux 9.0 i386
Redhat Linux 7.3 i686
Redhat Linux 7.3 i386
Redhat Linux 7.3
Redhat Fedora Core3
Redhat Fedora Core2
Redhat Fedora Core1
MIT Kerberos 5 5.0 -1.3.3
MIT Kerberos 5 5.0 -1.2beta2
MIT Kerberos 5 5.0 -1.2beta1
MIT Kerberos 5 5.0 -1.1.1
MIT Kerberos 5 5.0 -1.1
MIT Kerberos 5 5.0 -1.0.x
MIT Kerberos 5 1.3.5
+ Trustix Secure Enterprise Linux 2.0
+ Trustix Secure Linux 2.2
+ Trustix Secure Linux 2.1
MIT Kerberos 5 1.3.4
+ Mandriva Linux Mandrake 10.1 x86_64
 + Mandriva Linux Mandrake 10.1
+ Turbolinux Turbolinux Server 10.0
MIT Kerberos 5 1.3.3
MIT Kerberos 5 1.3.2
MIT Kerberos 5 1.3.1
MIT Kerberos 5 1.3 -alpha1
MIT Kerberos 5 1.3
+ Mandriva Linux Mandrake 10.0 AMD64
 + Mandriva Linux Mandrake 10.0
+ Mandriva Linux Mandrake 9.2 amd64
 + Mandriva Linux Mandrake 9.2
MIT Kerberos 5 1.2.8
MIT Kerberos 5 1.2.7
+ Mandriva Linux Mandrake 9.1 ppc
 + Mandriva Linux Mandrake 9.1
+ Redhat Linux 9.0 i386
 MIT Kerberos 5 1.2.6
MIT Kerberos 5 1.2.5
+ MandrakeSoft Corporate Server 2.1 x86_64
 + MandrakeSoft Corporate Server 2.1
+ Mandriva Linux Mandrake 9.0
+ Redhat Linux 8.0 i386
 + Redhat Linux 8.0
+ Turbolinux Home
+ Turbolinux Turbolinux 10 F...
 + Turbolinux Turbolinux Desktop 10.0
+ Turbolinux Turbolinux Server 8.0
+ Wirex Immunix OS 7+
 MIT Kerberos 5 1.2.4
+ Debian Linux 3.0 sparc
 + Debian Linux 3.0 s/390
 + Debian Linux 3.0 ppc
 + Debian Linux 3.0 mipsel
 + Debian Linux 3.0 mips
 + Debian Linux 3.0 m68k
 + Debian Linux 3.0 ia-64
 + Debian Linux 3.0 ia-32
 + Debian Linux 3.0 hppa
 + Debian Linux 3.0 arm
 + Debian Linux 3.0 alpha
 + Debian Linux 3.0
+ Redhat Linux 7.3 i386
 + Redhat Linux 7.3
MIT Kerberos 5 1.2.3
MIT Kerberos 5 1.2.2 -beta1
MIT Kerberos 5 1.2.2
+ MandrakeSoft Multi Network Firewall 2.0
+ Mandriva Linux Mandrake 8.2 ppc
 + Mandriva Linux Mandrake 8.2
+ Mandriva Linux Mandrake 8.1 ia64
 + Mandriva Linux Mandrake 8.1
+ Redhat Linux 7.2 ia64
 + Redhat Linux 7.2 i386
 + Redhat Linux 7.2
+ Redhat Linux 7.1 ia64
 + Redhat Linux 7.1 i386
 + Redhat Linux 7.1 alpha
 + Redhat Linux 7.1
+ Redhat Linux 7.0 i386
 + Redhat Linux 7.0 alpha
 + Redhat Linux 7.0
MIT Kerberos 5 1.2.1
MIT Kerberos 5 1.2
MIT Kerberos 5 1.1.1
- Redhat Linux 7.1 ia64
 - Redhat Linux 7.1 i386
 - Redhat Linux 7.1 alpha
 - Redhat Linux 7.1
- Redhat Linux 7.0 i386
 - Redhat Linux 7.0 alpha
 - Redhat Linux 7.0
+ Redhat Linux 6.2 sparc
 + Redhat Linux 6.2 i386
 + Redhat Linux 6.2 alpha
 + Redhat Linux 6.2
 MIT Kerberos 5 1.1
MIT Kerberos 5 1.0.8
+ OpenBSD OpenBSD 3.2
 + OpenBSD OpenBSD 3.1
 MIT Kerberos 5 1.0.6
MIT Kerberos 5 1.0
Debian Linux 3.0 sparc
Debian Linux 3.0 s/390
Debian Linux 3.0 ppc
Debian Linux 3.0 mipsel
Debian Linux 3.0 mips
Debian Linux 3.0 m68k
Debian Linux 3.0 ia-64
Debian Linux 3.0 ia-32
Debian Linux 3.0 hppa
Debian Linux 3.0 arm
Debian Linux 3.0 alpha
Debian Linux 3.0
Apple Mac OS X Server 10.3.9
Apple Mac OS X 10.3.9
Not Vulnerable: MIT Kerberos 5 1.3.6
+ Gentoo Linux
+ Redhat Fedora Core3
 + Redhat Fedora Core2
 + Redhat Fedora Core1
 + Trustix Secure Enterprise Linux 2.0
+ Trustix Secure Linux 2.2
+ Trustix Secure Linux 2.1

Discussion

MIT Kerberos 5 Administration Library Add_To_History Heap-Based Buffer Overflow Vulnerability

It is reported that the MIT Kerberos 5 administration library is affected by a heap-based buffer overflow vulnerability. The vulnerability presents itself in the 'add_to_history()' function of the 'svr_principal.c' source file. The vulnerability exists due to an indexing error that occurs under certain circumstances.

An authenticated attacker may potentially exploit this vulnerability on a Key Distribution Center (KDC) to execute arbitrary code in the context of the vulnerable service, ultimately resulting in the compromise of an entire Kerberos realm.

Exploit / POC

MIT Kerberos 5 Administration Library Add_To_History Heap-Based Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

MIT Kerberos 5 Administration Library Add_To_History Heap-Based Buffer Overflow Vulnerability

Solution:
MIT has released version 1.3.6 of their Kerberos 5 packages resolving this issue. Please see the referenced MIT release announcement for more information.

Turbolinux has made an advisory available (TLSA-2005-34) dealing with this issue. Please see the referenced advisory for more information.

SGI has released advisory 20050104-01-U (SGI Advanced Linux Environment 3 Security Update #24) to address various issues in SGI Advanced Linux Environment 3. This advisory includes updated SGI ProPack 3 Service Pack 3 packages and patch 10139. Please see the referenced advisory for more information.

Red Hat has released advisories FEDORA-2004-563 and FEDORA-2004-564 to address this issue in Fedora Core 2 and 3. Please see the referenced advisory for more information.

Trustix linux has made an advisory available (TSLSA-2004-0069) dealing with this issue. Trustix advises that all computers be upgraded to the latest version of the affected software using swup, the automated software updater. To auto-update the affected packages users are advised to issue the command 'swup --upgrade'. Please see the referenced advisory for more information.

Mandrake Linux has released and advisory (MDKSA-2004:156) along with fixes dealing with this issue. Please see the referenced advisory for more information.

Sun has released alert 57712 along with an upgrade dealing with this issue. Please see the referenced web advisory for more information.

Gentoo has released advisory GLSA 200501-05 to address this issue. Gentoo users may carry out the following commands to update their systems:
emerge --sync
emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.3.6"
Please see the referenced Gentoo advisory for more information.

Debian has released advisory DSA 629-1 to address this issue. Please see the referenced advisory for further information.

Ubuntu has released advisory USN-58-1 to address this issue. Please see the referenced advisory for more information.

Conectiva has released an advisory (CLSA-2005:917) to address this issue. Please see the advisory in references for more information.

Sun has updated advisory 57712 with fixes for Solaris 9 and SEAM for Solaris 8.

Fedora Legacy has released security advisory FLSA:154276 addressing this issue for RedHat Linux 7.3 and 9, and for Fedora Core 1. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

Apple has release security advisory APPLE-SA-2005-08-15 addressing this and several other vulnerabilities. Please see the referenced advisory for further information.


Sun Solaris 9

Sun Solaris 9_x86

MIT Kerberos 5 1.0

Sun SEAM 1.0.1

MIT Kerberos 5 1.0.6

MIT Kerberos 5 1.0.8

MIT Kerberos 5 1.1

MIT Kerberos 5 1.1.1

MIT Kerberos 5 1.2

MIT Kerberos 5 1.2.1

MIT Kerberos 5 1.2.2

MIT Kerberos 5 1.2.3

MIT Kerberos 5 1.2.4

MIT Kerberos 5 1.2.5

MIT Kerberos 5 1.2.6

MIT Kerberos 5 1.2.7

MIT Kerberos 5 1.2.8

MIT Kerberos 5 1.3

MIT Kerberos 5 1.3.1

MIT Kerberos 5 1.3.2

MIT Kerberos 5 1.3.3

MIT Kerberos 5 1.3.4

MIT Kerberos 5 1.3.5

Apple Mac OS X Server 10.3.9

Apple Mac OS X 10.3.9

SGI ProPack 3.0

References

MIT Kerberos 5 Administration Library Add_To_History Heap-Based Buffer Overflow Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report