Bug 838012 (CVE-2012-1015)

Summary:	CVE-2012-1015 krb5: KDC daemon crash via free() of an uninitialized pointer
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	dpal, jlieskov, jplans, jrusnack, nalin, security-response-team, sgadekar, timssubscription
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	krb5-1.9.5	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-07-31 21:44:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	839859, 839860, 844777
Bug Blocks:	838017

Description Huzaifa S. Sidhpurwala 2012-07-06 06:34:23 UTC

The MIT krb5 KDC (Key Distribution Center) daemon can free an uninitialized pointer while processing an unusual AS-REQ, corrupting the process heap and possibly causing the daemon to abnormally terminate.
An attacker could use this vulnerability to execute malicious code, but exploiting frees of uninitialized pointers to execute code is believed to be difficult. It is possible that a legitimate client that is misconfigured in an unusual way could trigger this vulnerability.

Note: Current glibc protections will cause invalid pointer frees to be reduced to crash only.

The KDC in releases krb5-1.8 and later is vulnerable to this flaw.

Reference: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt
Patch: http://web.mit.edu/kerberos/advisories/2012-001-patch.txt

Acknowledgements:
Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Emmanuel Bouillon (NCI Agency) as the original reporter of the flaw.

Comment 4 Huzaifa S. Sidhpurwala 2012-07-06 08:45:27 UTC

This issue does not affect the version of krb5 package as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of krb5 package as shipped with Red Hat Enterprise Linux 6.

This issue affects the version of krb5 package as shipped with Fedora-16 and Fedora-17.

Comment 8 Vincent Danen 2012-07-31 16:29:18 UTC

Statement:

Not vulnerable. This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5.

Comment 9 Vincent Danen 2012-07-31 18:23:59 UTC

External Reference:

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt

Comment 10 Vincent Danen 2012-07-31 18:26:01 UTC

Created krb5 tracking bugs for this issue

Affects: fedora-all [bug 844777]

Comment 11 errata-xmlrpc 2012-07-31 18:57:00 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1131 https://rhn.redhat.com/errata/RHSA-2012-1131.html

Comment 12 Tims-Linux 2012-08-02 08:34:55 UTC

I'm using RHEL 6.3 and version is 2.6.32-279.el6.x86_64. All my updates are up to date. Getting an error while trying to update below packages;
  krb5-devel-1.9-33.el6_3.2 (x86_64)
  krb5-libs-1.9-33.el6_3.2 (x86_64)

Here is message from Software update application;
failure: repodata/4a42f31b073aa87af77c0b072119d6ebb7c390d693250acf851eea978c565fe6-filelists.sqlite.bz2 from epel-debuginfo: [Errno 256] No more mirrors to try.

Comment 13 Tomas Hoger 2012-08-02 08:55:35 UTC

This issue seems completely unrelated to this update.  Temporary disabling repository (--disablerepo epel-debuginfo option to yum) can help, or you may prefer to disable the repo or mark it as skip_if_unavailable in the relevant repo file in /etc/yum.repos.d/, see yum.conf manual page for details.

If you need further assistance with doing such changes, please contact Red Hat Support: https://access.redhat.com/support/

Comment 14 Tims-Linux 2012-08-02 09:34:30 UTC

Thanks, it worked by disabling debuginfo repository

Comment 17 Jan Lieskovsky 2013-04-29 08:31:40 UTC

Kerberos 5 release krb5-1.9.5 announcement:
  http://web.mit.edu/kerberos/krb5-1.9/krb5-1.9.5.html#announcement