Red Hat Bugzilla – Full Text Bug Listing
|Summary:||CVE-2012-1015 krb5: KDC daemon crash via free() of an uninitialized pointer|
|Product:||[Other] Security Response||Reporter:||Huzaifa S. Sidhpurwala <huzaifas>|
|Component:||vulnerability||Assignee:||Red Hat Product Security <security-response-team>|
|Status:||CLOSED ERRATA||QA Contact:|
|Version:||unspecified||CC:||dpal, jlieskov, jplans, jrusnack, nalin, security-response-team, sgadekar, timssubscription|
|Fixed In Version:||krb5-1.9.5||Doc Type:||Bug Fix|
|Doc Text:||Story Points:||---|
|Last Closed:||2012-07-31 17:44:26 EDT||Type:||---|
|oVirt Team:||---||RHEL 7.3 requirements from Atomic Host:|
|Bug Depends On:||839859, 839860, 844777|
Description Huzaifa S. Sidhpurwala 2012-07-06 02:34:23 EDT
The MIT krb5 KDC (Key Distribution Center) daemon can free an uninitialized pointer while processing an unusual AS-REQ, corrupting the process heap and possibly causing the daemon to abnormally terminate. An attacker could use this vulnerability to execute malicious code, but exploiting frees of uninitialized pointers to execute code is believed to be difficult. It is possible that a legitimate client that is misconfigured in an unusual way could trigger this vulnerability. Note: Current glibc protections will cause invalid pointer frees to be reduced to crash only. The KDC in releases krb5-1.8 and later is vulnerable to this flaw. Reference: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt Patch: http://web.mit.edu/kerberos/advisories/2012-001-patch.txt Acknowledgements: Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Emmanuel Bouillon (NCI Agency) as the original reporter of the flaw.
Comment 4 Huzaifa S. Sidhpurwala 2012-07-06 04:45:27 EDT
This issue does not affect the version of krb5 package as shipped with Red Hat Enterprise Linux 5. This issue affects the version of krb5 package as shipped with Red Hat Enterprise Linux 6. This issue affects the version of krb5 package as shipped with Fedora-16 and Fedora-17.
Comment 8 Vincent Danen 2012-07-31 12:29:18 EDT
Statement: Not vulnerable. This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5.
Comment 9 Vincent Danen 2012-07-31 14:23:59 EDT
External Reference: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt
Comment 10 Vincent Danen 2012-07-31 14:26:01 EDT
Created krb5 tracking bugs for this issue Affects: fedora-all [bug 844777]
Comment 11 errata-xmlrpc 2012-07-31 14:57:00 EDT
This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2012:1131 https://rhn.redhat.com/errata/RHSA-2012-1131.html
Comment 12 Tims-Linux 2012-08-02 04:34:55 EDT
I'm using RHEL 6.3 and version is 2.6.32-279.el6.x86_64. All my updates are up to date. Getting an error while trying to update below packages; krb5-devel-1.9-33.el6_3.2 (x86_64) krb5-libs-1.9-33.el6_3.2 (x86_64) Here is message from Software update application; failure: repodata/4a42f31b073aa87af77c0b072119d6ebb7c390d693250acf851eea978c565fe6-filelists.sqlite.bz2 from epel-debuginfo: [Errno 256] No more mirrors to try.
Comment 13 Tomas Hoger 2012-08-02 04:55:35 EDT
This issue seems completely unrelated to this update. Temporary disabling repository (--disablerepo epel-debuginfo option to yum) can help, or you may prefer to disable the repo or mark it as skip_if_unavailable in the relevant repo file in /etc/yum.repos.d/, see yum.conf manual page for details. If you need further assistance with doing such changes, please contact Red Hat Support: https://access.redhat.com/support/
Comment 14 Tims-Linux 2012-08-02 05:34:30 EDT
Thanks, it worked by disabling debuginfo repository
Comment 17 Jan Lieskovsky 2013-04-29 04:31:40 EDT
Kerberos 5 release krb5-1.9.5 announcement: http://web.mit.edu/kerberos/krb5-1.9/krb5-1.9.5.html#announcement