Bug 648734 (CVE-2010-1323)

Summary:	CVE-2010-1323 krb5: incorrect acceptance of certain checksums (MITKRB5-SA-2010-007)
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dpal, jplans, mjc, nalin, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-06-20 16:58:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	651962, 651963, 652307, 652308, 652312, 652313
Bug Blocks:

Description Vincent Danen 2010-11-01 23:57:53 UTC

Multiple checksum handling vulnerabilities were found in the MIT krb5 GSS-API
library:

* krb5 clients may accept unkeyed SAM-2 challenge checksums
* krb5 may accept KRB-SAFE checksums with low-entropy derived keys

The first flaw can allow an unauthenticated remote attacker to alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC.  Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism toekn.

The second flaw allows an unauthenticated remote attacker to have a 1/256 chance of forging KRB-SAFE messages in an application protocol, if the targeted pre-existing session uses an RC4 session key.  Few application protocols use KRB-SAFE messages.

These flaws affect MIT krb5 version 1.3 and newer.

A patch to correct this flaw, as well the other flaws noted in
MITKRB5-SA-2010-007 are available from
http://web.mit.edu/kerberos/advisories/2010-007-patch.txt (v1.8),
http://web.mit.edu/kerberos/advisories/2010-007-patch-r17.txt (v1.7),
http://web.mit.edu/kerberos/advisories/2010-007-patch-r16.txt (v1.6), and
http://web.mit.edu/kerberos/advisories/2010-007-patch-r15.txt (v1.5).

These issues are collectively known as CVE-2010-1323.  The upstream
announcement is available at
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2010-007.txt.


Acknowledgements:

Red Hat would like to thank the MIT Kerberos Team for reporting this issue.

Comment 9 errata-xmlrpc 2010-11-30 22:43:54 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2010:0925 https://rhn.redhat.com/errata/RHSA-2010-0925.html

Comment 10 errata-xmlrpc 2010-11-30 22:59:18 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2010:0926 https://rhn.redhat.com/errata/RHSA-2010-0926.html