Bug 838012 (CVE-2012-1015)

Summary: CVE-2012-1015 krb5: KDC daemon crash via free() of an uninitialized pointer
Product: [Other] Security Response Reporter: Huzaifa S. Sidhpurwala <huzaifas>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: dpal, jlieskov, jplans, jrusnack, nalin, security-response-team, sgadekar, timssubscription
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=important,public=20120731,reported=20120706,source=upstream,cvss2=5.0/AV:N/AC:L/Au:N/C:N/I:N/A:P,rhel-5/krb5=notaffected,rhel-6/krb5=affected,fedora-all/krb5=affected
Fixed In Version: krb5-1.9.5 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-07-31 17:44:26 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On: 839859, 839860, 844777    
Bug Blocks: 838017    

Description Huzaifa S. Sidhpurwala 2012-07-06 02:34:23 EDT
The MIT krb5 KDC (Key Distribution Center) daemon can free an uninitialized pointer while processing an unusual AS-REQ, corrupting the process heap and possibly causing the daemon to abnormally terminate.
An attacker could use this vulnerability to execute malicious code, but exploiting frees of uninitialized pointers to execute code is believed to be difficult. It is possible that a legitimate client that is misconfigured in an unusual way could trigger this vulnerability.

Note: Current glibc protections will cause invalid pointer frees to be reduced to crash only.

The KDC in releases krb5-1.8 and later is vulnerable to this flaw.

Reference: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt
Patch: http://web.mit.edu/kerberos/advisories/2012-001-patch.txt

Acknowledgements:
Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Emmanuel Bouillon (NCI Agency) as the original reporter of the flaw.
Comment 4 Huzaifa S. Sidhpurwala 2012-07-06 04:45:27 EDT
This issue does not affect the version of krb5 package as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of krb5 package as shipped with Red Hat Enterprise Linux 6.

This issue affects the version of krb5 package as shipped with Fedora-16 and Fedora-17.
Comment 8 Vincent Danen 2012-07-31 12:29:18 EDT
Statement:

Not vulnerable. This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5.
Comment 9 Vincent Danen 2012-07-31 14:23:59 EDT
External Reference:

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt
Comment 10 Vincent Danen 2012-07-31 14:26:01 EDT
Created krb5 tracking bugs for this issue

Affects: fedora-all [bug 844777]
Comment 11 errata-xmlrpc 2012-07-31 14:57:00 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1131 https://rhn.redhat.com/errata/RHSA-2012-1131.html
Comment 12 Tims-Linux 2012-08-02 04:34:55 EDT
I'm using RHEL 6.3 and version is 2.6.32-279.el6.x86_64. All my updates are up to date. Getting an error while trying to update below packages;
  krb5-devel-1.9-33.el6_3.2 (x86_64)
  krb5-libs-1.9-33.el6_3.2 (x86_64)

Here is message from Software update application;
failure: repodata/4a42f31b073aa87af77c0b072119d6ebb7c390d693250acf851eea978c565fe6-filelists.sqlite.bz2 from epel-debuginfo: [Errno 256] No more mirrors to try.
Comment 13 Tomas Hoger 2012-08-02 04:55:35 EDT
This issue seems completely unrelated to this update.  Temporary disabling repository (--disablerepo epel-debuginfo option to yum) can help, or you may prefer to disable the repo or mark it as skip_if_unavailable in the relevant repo file in /etc/yum.repos.d/, see yum.conf manual page for details.

If you need further assistance with doing such changes, please contact Red Hat Support: https://access.redhat.com/support/
Comment 14 Tims-Linux 2012-08-02 05:34:30 EDT
Thanks, it worked by disabling debuginfo repository
Comment 17 Jan Lieskovsky 2013-04-29 04:31:40 EDT
Kerberos 5 release krb5-1.9.5 announcement:
  http://web.mit.edu/kerberos/krb5-1.9/krb5-1.9.5.html#announcement