Updated Kerberos packages for IBM iSeries and pSeries systems fix a number of vulnerabilities found in MIT Kerberos.
Kerberos is a network authentication system. The MIT Kerberos team released an advisory describing a number of vulnerabilities that affect the kerberos packages shipped by Red Hat. These vulnerabilities include: An integer signedness error in the ASN.1 decoder before version 1.2.5 allows remote attackers to cause a denial of service (crash) via a large unsigned data element length, which is later used as a negative value. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0036 to this issue. The Key Distribution Center (KDC) before version 1.2.5 allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes a null dereference (CAN-2003-0058). The Key Distribution Center (KDC) allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (CAN-2003-0072). The Key Distribution Center (KDC) allows remote, authenticated attackers to cause a denial of service (crash) on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (CAN-2003-0082). A vulnerability in Kerberos before version 1.2.3 allows users from one realm to impersonate users in other realms that have the same inter-realm keys (CAN-2003-0059). The MIT advisory for these issues also mentions format string vulnerabilities in the logging routines (CAN-2003-0060). Previous versions of the kerberos packages from Red Hat already contain fixes for this issue. Vulnerabilities have been found in the support for triple-DES keys in the implementation of the Kerberos IV authentication protocol, which is included in MIT Kerberos (CAN-2003-0139). Vulnerabilities have been found in the Kerberos IV authentication protocol that allow an attacker with knowledge of a cross-realm key, which is shared with another realm, to impersonate any principal in that realm to any service in that realm. This vulnerability can only be closed by disabling cross-realm authentication in Kerberos IV (CAN-2003-0138). Vulnerabilities have been found in the RPC library used by the kadmin service in Kerberos 5. A faulty length check in the RPC library exposes kadmind to an integer overflow, which can be used to crash kadmind (CAN-2003-0028). The Kerberos 5 network authentication system contains an RPC library which includes an XDR decoder derived from Sun's RPC implementation. The Sun implementation was recently demonstrated to be vulnerable to a heap overflow. It is believed that the attacker needs to be able to authenticate to the kadmin daemon for this attack to be successful (CVE-2002-0391). A stack buffer overflow was found in the implementation of the Kerberos v4 compatibility administration daemon (kadmind4), which is part of the the MIT krb5 distribution, but not enabled or used by default in Red Hat Linux. This vulnerability could be exploited to gain unauthorized root access to a KDC host. The attacker does not need to authenticate to the daemon to successfully perform this attack (CAN-2002-1235). A problem has been found in the Kerberos ftp client. When retrieving a file with a filename beginning with a pipe character, the ftp client will pass the filename to the command shell in a system() call. This could allow a malicious ftp server to write to files outside of the current directory or execute commands as the user running the ftp client (CAN-2003-0041). All users of Kerberos are advised to upgrade to these errata packages, which disable cross-realm authentication by default for Kerberos IV and which contain backported patches that correct these issues.