MIT Kerberos Multiple Denial of Service Vulnerabilities

Bugtraq ID:	50273
Class:	Unknown
CVE:	CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 CVE-2011-4151
Remote:	Yes
Local:	No
Published:	Oct 19 2011 12:00AM
Updated:	Jan 23 2012 11:10PM
Credit:	MIT, Nalin Dahyabhai, Andrej Ota, Kyle Moffett and Mark Deneen.
Vulnerable:	Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE openSUSE 11.4 SuSE openSUSE 11.3 Red Hat Fedora 15 Red Hat Fedora 14 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6 MIT Kerberos 5 1.8.4 MIT Kerberos 5 1.8.3 MIT Kerberos 5 1.8.2 MIT Kerberos 5 1.8.1 MIT Kerberos 5 1.9 MIT Kerberos 5 1.8 Mandriva Linux Mandrake 2011 x86_64 Mandriva Linux Mandrake 2011 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

MIT Kerberos Multiple Denial of Service Vulnerabilities

MIT Kerberos is prone to multiple remote denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the KDC service, resulting in a denial-of-service condition. Due to the nature of some of these issues, arbitrary code execution may be possible; however, this has not been confirmed.

MIT Kerberos Multiple Denial of Service Vulnerabilities

Attackers can exploit these issues with readily available networking tools.

MIT Kerberos Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


MandrakeSoft Enterprise Server 5 x86_64

• Mandriva krb5-1.8.1-0.7mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-pkinit-openssl-1.8.1-0.7mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-1.8.1-0.7mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-ldap-1.8.1-0.7mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-workstation-1.8.1-0.7mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64krb53-1.8.1-0.7mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64krb53-devel-1.8.1-0.7mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MandrakeSoft Enterprise Server 5

• Mandriva krb5-1.8.1-0.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-pkinit-openssl-1.8.1-0.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-1.8.1-0.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-ldap-1.8.1-0.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-workstation-1.8.1-0.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libkrb53-1.8.1-0.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libkrb53-devel-1.8.1-0.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

MIT Kerberos 5 1.8

• MIT MITKRB5-SA-2011-006 krb5-1.8.x
  http://web.mit.edu/kerberos/advisories/2011-006-patch-r18.txt

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva krb5-1.8.1-5.6mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-pkinit-openssl-1.8.1-5.6mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-1.8.1-5.6mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-ldap-1.8.1-5.6mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-workstation-1.8.1-5.6mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64krb53-1.8.1-5.6mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64krb53-devel-1.8.1-5.6mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/downloads/

MIT Kerberos 5 1.9

• MIT MITKRB5-SA-2011-006 krb5-1.9.x
  http://web.mit.edu/kerberos/advisories/2011-006-patch.txt

Mandriva Linux Mandrake 2010.1

• Mandriva krb5-1.8.1-5.6mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-pkinit-openssl-1.8.1-5.6mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-1.8.1-5.6mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-ldap-1.8.1-5.6mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-workstation-1.8.1-5.6mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libkrb53-1.8.1-5.6mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libkrb53-devel-1.8.1-5.6mdv2010.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2011 x86_64

• Mandriva krb5-1.9.1-1.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-pkinit-openssl-1.9.1-1.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-1.9.1-1.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-ldap-1.9.1-1.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-workstation-1.9.1-1.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64krb53-1.9.1-1.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva lib64krb53-devel-1.9.1-1.1-mdv2011.0.x86_64.rpm
  http://www.mandriva.com/en/downloads/

Mandriva Linux Mandrake 2011

• Mandriva krb5-1.9.1-1.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-pkinit-openssl-1.9.1-1.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-1.9.1-1.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-server-ldap-1.9.1-1.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva krb5-workstation-1.9.1-1.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libkrb53-1.9.1-1.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libkrb53-devel-1.9.1-1.1-mdv2011.0.i586.rpm
  http://www.mandriva.com/en/downloads/

MIT Kerberos 5 1.8.1

• MIT MITKRB5-SA-2011-006 krb5-1.8.x
  http://web.mit.edu/kerberos/advisories/2011-006-patch-r18.txt

MIT Kerberos 5 1.8.2

• MIT MITKRB5-SA-2011-006 krb5-1.8.x
  http://web.mit.edu/kerberos/advisories/2011-006-patch-r18.txt

MIT Kerberos 5 1.8.3

• MIT MITKRB5-SA-2011-006 krb5-1.8.x
  http://web.mit.edu/kerberos/advisories/2011-006-patch-r18.txt

MIT Kerberos 5 1.8.4

• MIT MITKRB5-SA-2011-006 krb5-1.8.x
  http://web.mit.edu/kerberos/advisories/2011-006-patch-r18.txt

MIT Kerberos Multiple Denial of Service Vulnerabilities

References:

• Kerberos Homepage (MIT)
  
• MIT krb5 Security Advisory 2011-006 (MIT)