BID:25533

MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execution Vulnerability

Info

MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execution Vulnerability

Bugtraq ID:	25533
Class:	Design Error
CVE:	CVE-2007-4000
Remote:	Yes
Local:	No
Published:	Sep 04 2007 12:00AM
Updated:	Sep 11 2007 10:01PM
Credit:	Garrett Wollman of MIT CSAIL is credited with discovering this issue.
Vulnerable:	Redhat Fedora Core6 Redhat Fedora 7 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server MIT Kerberos 5 1.6.2 MIT Kerberos 5 1.6.1 MIT Kerberos 5 1.6 MIT Kerberos 5 1.5.4 MIT Kerberos 5 1.5.3 MIT Kerberos 5 1.5.2 MIT Kerberos 5 1.5.1 MIT Kerberos 5 1.5 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 Mandriva Linux Mandrake 2007.0 x86_64 Mandriva Linux Mandrake 2007.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux

Not Vulnerable:	MIT Kerberos 5 1.6.3

Discussion

MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execution Vulnerability

Kerberos 5 'kadmind' (Kerberos Administration Daemon) server is prone to a remote code-execution vulnerability because of an uninitialized pointer.

An authenticated attacker can exploit this issue to execute arbitrary code with superuser privileges. Successful exploits will completely compromise affected computers. Failed attacks will cause denial-of-service conditions.

All 'kadmind' servers run on the master Kerberos server. Since the master server holds the KDC principal and policy database, an attack may not only compromise the affected computer, but could also compromise multiple hosts that use the server for authentication.

Kerberos 5 'kadmind' 1.5 through 1.6.2 are vulnerable.

Exploit / POC

MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execution Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Solution / Fix

MIT Kerberos 5 kadmind Server Uninitialized Pointer Remote Code Execution Vulnerability

Solution:
The vendor has released fixes to address this issue. Please see the references for more information.

MIT Kerberos 5 1.5