Bug 1174543 (CVE-2014-5353)

Summary:	CVE-2014-5353 krb5: NULL pointer dereference when using a ticket policy name as a password policy name
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbaranow, bmaxwell, cdewolf, csutherl, dandread, darran.lofthouse, dknox, dpal, fnasser, jason.greene, jawilson, jboss-set, jclere, jdoyle, jplans, kerberos-dev-list, lgao, mbabacek, myarboro, nalin, nathaniel, pgier, pkis, psakar, pslavice, rsvoboda, security-response-team, twalsh, vtunka, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	If kadmind were used with an LDAP back end for the KDC database, a remote, authenticated attacker who has the permissions to set the password policy could crash kadmind by attempting to use a named ticket policy object as a password policy for a principal.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-04 08:48:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1174544, 1174985, 1205561, 1205562
Bug Blocks:	1174549, 1179866

Description Murray McAllister 2014-12-16 02:37:25 UTC

If kadmind were used with an LDAP back end for the KDC database, a remote, authenticated attacker who has the permissions to set the password policy could crash kadmind by attempting to use a named ticket policy object as a password policy for a principal.

Upstream fix:

https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3

Reference:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226

Comment 1 Murray McAllister 2014-12-16 02:38:20 UTC

Created krb5 tracking bugs for this issue:

Affects: fedora-all [bug 1174544]

Comment 4 Huzaifa S. Sidhpurwala 2014-12-19 05:08:15 UTC

Statement:

This issue affects the version of krb5 package as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This issue is not planned to be addressed in Red Hat Enterprise Linux 5. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 9 errata-xmlrpc 2015-03-05 10:01:31 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0439 https://rhn.redhat.com/errata/RHSA-2015-0439.html

Comment 12 Patrik Kis 2015-04-03 09:06:49 UTC

*** Bug 1163411 has been marked as a duplicate of this bug. ***

Comment 13 errata-xmlrpc 2015-04-09 05:09:21 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:0794 https://rhn.redhat.com/errata/RHSA-2015-0794.html

Comment 14 Fedora Update System 2015-04-22 22:50:03 UTC

krb5-1.13.1-2.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2015-06-21 00:28:42 UTC

krb5-1.12.2-17.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.