Bug 1179861 (CVE-2014-9422)

Summary:	CVE-2014-9422 krb5: kadmind incorrectly validates server principal name (MITKRB5-SA-2015-001)
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bbaranow, bmaxwell, cdewolf, chris.cumbaa.ctr, csutherl, dandread, darran.lofthouse, dpal, fnasser, gnaik, grocha, jason.greene, jawilson, jboss-set, jclere, jdoyle, jplans, lgao, myarboro, nalin, pgier, pkis, psakar, pslavice, rsvoboda, security-response-team, twalsh, vtunka, weli
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that the MIT Kerberos administration server (kadmind) incorrectly accepted certain authentication requests for two-component server principal names. A remote attacker able to acquire a key with a particularly named principal (such as "kad/x") could use this flaw to impersonate any user to kadmind, and perform administrative actions as that user.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-11-04 08:47:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1181208, 1182882, 1182883, 1188869
Bug Blocks:	1121513, 1179866

Description Vasyl Kaigorodov 2015-01-07 16:47:59 UTC

Upstream reports that the MIT krb5 kadmind daemon incorrectly accepts
authentications to two-component server principals whose first
component is a left substring of "kadmin" or whose realm is a left
prefix of the default realm.

An attacker who possess the key of a particularly named
principal (such as "kad/root") could impersonate any user to kadmind
and perform administrative actions as that user.

When kadmind receives a request using the RPCSEC_GSS authentication
flavor, it queries the GSS-API security context for the server
principal name and attempts to verify that it is a two-component
principal name where the first component is "kadmin", the second
component is not "history", and the realm is the default realm.

The validation function incorrectly uses strcmp() to compare the
length-counted principal name components against null-terminated C
strings for "kadmin", "history", and the default realm.  These
comparisons erroneously succeed for left substrings of the of the
desired C strings, so for example a first principal name component of
"ka" would be accepted.

kadmind can receive authentications to any server principal entry in
the Kerberos database (excluding entries with either the DISALLOW_SVR
or DISALLOW_ALL_TIX flags set).  If the database contains an
erroneously matching principal entry such as "ka/x", and an attacker
knows the key for that entry, the attacker can conduct an escalation
of privilege attack by forging tickets from any client principal name
to that server principal.  By picking a client principal name with
administrative privileges, the attacker could perform arbitrary
administrative operations on the Kerberos database.

Suggested patch to fix this issue, as well as CVE-2014-5352, CVE-2014-9421
and CVE-2014-9423 is attached to https://bugzilla.redhat.com/show_bug.cgi?id=1179856

Comment 1 Vasyl Kaigorodov 2015-01-07 17:03:04 UTC

Acknowledgements:

Red Hat would like to thank the MIT Kerberos project for reporting this issue.

Comment 2 Vasyl Kaigorodov 2015-01-12 15:18:43 UTC

According to MIT kadmind is vulnerable in all released versions of MIT krb5.

Comment 5 Vincent Danen 2015-02-03 21:19:48 UTC

External References:

http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2015-001.txt

Comment 6 Vincent Danen 2015-02-03 21:38:36 UTC

Created krb5 tracking bugs for this issue:

Affects: fedora-all [bug 1188869]

Comment 7 Tomas Hoger 2015-02-04 19:44:31 UTC

Upstream commit:

https://github.com/krb5/krb5/commit/6609658db0799053fbef0d7d0aa2f1fd68ef32d8

Comment 8 Vasyl Kaigorodov 2015-03-02 09:16:12 UTC

Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 9 errata-xmlrpc 2015-03-05 10:01:43 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0439 https://rhn.redhat.com/errata/RHSA-2015-0439.html

Comment 11 Fedora Update System 2015-03-09 08:18:23 UTC

krb5-1.11.5-18.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Roland Mainz 2015-03-09 17:05:02 UTC

(In reply to Ganesh from comment #10)
> RHEL 6 is never mentioned on this Bug. Customer saw that these affect RHEL 6
> however. Do we have plan to release a fix for 6?

It's part of krb5-1.10.3-35.el6_6 (RHEL6.6.z) ...

Comment 13 Chris Cumbaa 2015-03-12 14:08:35 UTC

> This issue has been addressed in the following products:
> 
>   Red Hat Enterprise Linux 7
> 
> Via RHSA-2015:0439 https://rhn.redhat.com/errata/RHSA-2015-0439.html

It's been a week since the fix for RHEL7 was published and still no mention of RHEL6. Is it in-process?(In reply to errata-xmlrpc from comment #9)

Comment 14 Roland Mainz 2015-03-12 14:35:06 UTC

(In reply to Chris Cumbaa from comment #13)
> > This issue has been addressed in the following products:
> > 
> >   Red Hat Enterprise Linux 7
> > 
> > Via RHSA-2015:0439 https://rhn.redhat.com/errata/RHSA-2015-0439.html
> 
> It's been a week since the fix for RHEL7 was published and still no mention
> of RHEL6. Is it in-process?

See comment #12 ...

Comment 15 Fedora Update System 2015-03-12 16:33:45 UTC

krb5-1.12.2-14.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 errata-xmlrpc 2015-04-09 05:09:29 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:0794 https://rhn.redhat.com/errata/RHSA-2015-0794.html