Bug 415351 (CVE-2007-5971)

Summary: CVE-2007-5971 krb5: double free in gssapi lib
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: kreilly, nalin
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-5971
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-03-31 09:43:07 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 434923, 434924, 435883, 435884, 438022, 438023    
Bug Blocks:    

Description Tomas Hoger 2007-12-07 08:47:58 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-5971 to the following vulnerability:

Double-free vulnerability in the gss_krb5int_make_seal_token_v3 function in lib/gssapi/krb5/k5sealv3.c in MIT Kerberos 5 (krb5) has unknown impact and attack vectors.

References:

http://bugs.gentoo.org/show_bug.cgi?id=199212

Comment 2 Mark J. Cox 2007-12-14 09:41:42 UTC
MIT say
http://marc.info/?l=full-disclosure&m=119743235325151&w=2

CVE-2007-5971
http://bugs.gentoo.org/show_bug.cgi?id=199212

This bug is a double-free condition which is not a practical
vulnerability due to the extreme difficulty of exploitation.  If
krb5_c_make_checksum() (in src/lib/gssapi/krb5/k5sealv3.c) fails,
"outbuf" may be freed twice.

   244          err = krb5_c_make_checksum(context, ctx->cksumtype, key,
   245                                     key_usage, &plain, &sum);
   246          zap(plain.data, plain.length);
   247          free(plain.data);
   248          plain.data = 0;
   249          if (err) {
   250              zap(outbuf,bufsize);
   251              free(outbuf);
   252              goto error;
   253          }
...
   290  error:
   291      free(outbuf);
   292      token->value = NULL;
   293      token->length = 0;
   294      return err;
   295  }

krb5_c_make_checksum() only fails if malloc() fails to allocate a very
small amount of memory.  To exploit this vulnerability, an attacker
would need to force a malloc() failure at exactly the point where
krb5_c_make_checksum is called.


Comment 3 Tomas Hoger 2008-02-18 13:21:49 UTC
Upstream bug report:

http://krbdev.mit.edu/rt/Ticket/Display.html?id=5856

Fix seems to be tagged for inclusion in upstream version 1.6.4.

Comment 4 Tomas Hoger 2008-02-18 13:50:07 UTC
Upstream SVN commit:

http://anonsvn.mit.edu/cgi-bin/viewcvs.cgi?view=rev&rev=20180

Comment 9 Fedora Update System 2008-03-18 18:49:45 UTC
krb5-1.6.1-9.fc7 has been submitted as an update for Fedora 7

Comment 10 Fedora Update System 2008-03-18 18:50:37 UTC
krb5-1.6.2-14.fc8 has been submitted as an update for Fedora 8

Comment 11 Fedora Update System 2008-03-21 22:17:04 UTC
krb5-1.6.1-9.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2008-03-21 22:20:07 UTC
krb5-1.6.2-14.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.