MIT Kerberos krb5-appl FTP Daemon EGID Remote Privilege Escalation Vulnerability

Bugtraq ID:	48571
Class:	Design Error
CVE:	CVE-2011-1526
Remote:	Yes
Local:	No
Published:	Jul 05 2011 12:00AM
Updated:	Apr 13 2015 09:16PM
Credit:	Tim Zingelman
Vulnerable:	S.u.S.E. openSUSE 11.4 S.u.S.E. openSUSE 11.3 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Oracle Enterprise Linux 5 MIT krb5-appl 1.0.1 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Avaya Proactive Contact 5.0 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IQ 5 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2
Not Vulnerable:

MIT Kerberos krb5-appl FTP Daemon EGID Remote Privilege Escalation Vulnerability

MIT Kerberos krb5-appl ftpd is prone to a remote privilege-escalation vulnerability.

Successful exploits will allow authenticated attackers to read or write files whose group owner is the initial effective group ID (EGID) of the FTP daemon process. In certain configurations, this may be GID 0 (the 'root' or 'wheel' group).

Kerberos krb5-appl 1.0.1 is vulnerable.

MIT Kerberos krb5-appl FTP Daemon EGID Remote Privilege Escalation Vulnerability

Attackers can use readily available tools to exploit this issue.

MIT Kerberos krb5-appl FTP Daemon EGID Remote Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva krb5-appl-clients-1.0-0.3mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-appl-servers-1.0-0.3mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva krb5-appl-clients-1.0-0.3mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-appl-servers-1.0-0.3mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva krb5-appl-clients-1.0-4.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-appl-servers-1.0-4.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MIT krb5-appl 1.0.1

• MIT 2011-005-patch
  http://web.mit.edu/kerberos/advisories/2011-005-patch.txt

Mandriva Linux Mandrake 2010.1

• Mandriva krb5-appl-clients-1.0-4.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-appl-servers-1.0-4.1mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/

MIT Kerberos krb5-appl FTP Daemon EGID Remote Privilege Escalation Vulnerability

References:

• Bug 711419 - (CVE-2011-1526) CVE-2011-1526 krb5, krb5-appl: ftpd incorrect group (Jan Lieskovsky)
  
• Kerberos Homepage (MIT)
  
• ASA-2012-199 krb5 security and bug fix update (RHSA-2012-0306) (Avaya)
  
• MITKRB5-SA-2011-005 FTP daemon fails to set effective group ID (MIT)