This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours

Bug 917840 (CVE-2012-1016)

Summary: CVE-2012-1016 krb5: PKINIT null pointer deref leads to DoS
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dpal, jlieskov, jplans, nalin, nathaniel
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,public=20130215,reported=20130302,source=cve,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P,rhel-4/krb5=notaffected,rhel-5/krb5=notaffected,rhel-6/krb5=affected,fedora-all/krb5=affected,cwe=CWE-476[auto]
Fixed In Version: krb5-1.10.4 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-03 14:18:44 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 924620, 917841, 917909, 917910    
Bug Blocks: 914754    

Description Vincent Danen 2013-03-04 17:01:08 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-1016 to
the following vulnerability:

Name: CVE-2012-1016
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1016
Assigned: 20120207
Reference: http://krbdev.mit.edu/rt/Ticket/Display.html?id=7527
Reference: http://web.mit.edu/kerberos/www/krb5-1.10/
Reference: https://github.com/krb5/krb5/commit/db64ca25d661a47b996b4e2645998b5d7f0eb52c

The pkinit_server_return_padata function in
plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in
the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before
1.10.4 attempts to find an agility KDF identifier in inappropriate
circumstances, which allows remote attackers to cause a denial of
service (NULL pointer dereference and daemon crash) via a crafted
Draft 9 request.


External References:

http://krbdev.mit.edu/rt/Ticket/Display.html?id=7527
http://web.mit.edu/kerberos/www/krb5-1.10/


Statement:

This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5 as they did not include support for PKINIT.
Comment 1 Vincent Danen 2013-03-04 17:03:21 EST
Created krb5 tracking bugs for this issue

Affects: fedora-all [bug 917841]
Comment 2 Vincent Danen 2013-03-04 17:07:28 EST
It also looks as though this does not affect krb5 1.11 as there is no reference to this CVE in the changes for 1.11.1 (http://web.mit.edu/kerberos/www/krb5-1.11/), or it has not been fixed upstream on 1.11.x yet.  I've not checked to see which is the case yet.
Comment 4 Nalin Dahyabhai 2013-03-05 11:51:16 EST
(In reply to comment #2)
> It also looks as though this does not affect krb5 1.11 as there is no
> reference to this CVE in the changes for 1.11.1
> (http://web.mit.edu/kerberos/www/krb5-1.11/), or it has not been fixed
> upstream on 1.11.x yet.  I've not checked to see which is the case yet.

This was fixed there as http://krbdev.mit.edu/rt/Ticket/Display.html?id=7506.
Comment 5 Fedora Update System 2013-03-15 21:31:38 EDT
krb5-1.10.2-9.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 errata-xmlrpc 2013-03-18 14:04:39 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0656 https://rhn.redhat.com/errata/RHSA-2013-0656.html
Comment 7 Fedora Update System 2013-03-22 17:08:26 EDT
krb5-1.10.3-14.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Jan Lieskovsky 2013-03-29 12:14:40 EDT
This issue did not affect the version of the krb5 package, as shipped with Red Hat Enterprise Linux 4.