Bug 432621 (CVE-2008-0063)

Summary:	CVE-2008-0063 krb5: possible leak of sensitive data from krb5kdc using krb4 request
Product:	[Other] Security Response	Reporter:	Tomas Hoger <thoger>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	kreilly, nalin, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-03-31 09:40:32 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	434923, 434924, 435881, 435882, 435883, 435884, 435885, 438022, 438023
Bug Blocks:

Description Tomas Hoger 2008-02-13 13:26:34 UTC

MIT Kerberos Team reported following issue affecting MIT Kerberos 5 KDC with
Kerberos 4 support enabled:

CVE-2008-0063: The incoming krb4 message is copied into a fixed-size
buffer on the stack, but the remainder of the buffer is left
untouched, and the bounds checks use the size of the buffer, not the
size of the data copied into it.

Acknowledgements:

Red Hat would like to thank MIT for reporting this issue.

Comment 3 Tomas Hoger 2008-02-13 14:01:00 UTC

See bug bug #432620 for patch.

Comment 4 Tomas Hoger 2008-02-15 14:07:01 UTC

This issue affects krb5 packages as shipped in Red Hat Enterprise Linux 2.1, 3,
4 and 5 and current versions of Fedora.  Support for Kerberos v4 is not assumed
by default by krb5kdc on Red Hat Enterprise Linux 5 and Fedora, however default
configuration in kdc.conf enables this support explicitly (in nopreauth mode,
which is assumed and configured as default on Red Hat Enterprise Linux 2.1, 3
and 4).

Possible workaround -- disable v4 support if it's not needed -- in kdc.conf, set
v4_mode to none.

Comment 10 Tomas Hoger 2008-03-18 18:18:34 UTC

Public now:

  http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-001.txt

Lifting embargo.

Comment 12 Fedora Update System 2008-03-18 18:49:48 UTC

krb5-1.6.1-9.fc7 has been submitted as an update for Fedora 7

Comment 13 Fedora Update System 2008-03-18 18:50:42 UTC

krb5-1.6.2-14.fc8 has been submitted as an update for Fedora 8

Comment 14 Fedora Update System 2008-03-21 22:17:08 UTC

krb5-1.6.1-9.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2008-03-21 22:20:11 UTC

krb5-1.6.2-14.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Red Hat Product Security 2008-03-31 09:40:32 UTC

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2008-0180.html
  http://rhn.redhat.com/errata/RHSA-2008-0181.html
  http://rhn.redhat.com/errata/RHSA-2008-0182.html
  http://rhn.redhat.com/errata/RHSA-2008-0164.html

Fedora:
  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-2637
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-2647