Bug 1179861 (CVE-2014-9422) - CVE-2014-9422 krb5: kadmind incorrectly validates server principal name (MITKRB5-SA-2015-001)
Summary: CVE-2014-9422 krb5: kadmind incorrectly validates server principal name (MITK...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-9422
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1181208 1182882 1182883 1188869
Blocks: 1121513 1179866
TreeView+ depends on / blocked
 
Reported: 2015-01-07 16:47 UTC by Vasyl Kaigorodov
Modified: 2021-02-17 05:51 UTC (History)
29 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was found that the MIT Kerberos administration server (kadmind) incorrectly accepted certain authentication requests for two-component server principal names. A remote attacker able to acquire a key with a particularly named principal (such as "kad/x") could use this flaw to impersonate any user to kadmind, and perform administrative actions as that user.
Clone Of:
Environment:
Last Closed: 2015-11-04 08:47:56 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:0439 0 normal SHIPPED_LIVE Moderate: krb5 security, bug fix and enhancement update 2015-03-05 14:38:14 UTC
Red Hat Product Errata RHSA-2015:0794 0 normal SHIPPED_LIVE Moderate: krb5 security update 2015-04-09 09:09:12 UTC

Description Vasyl Kaigorodov 2015-01-07 16:47:59 UTC
Upstream reports that the MIT krb5 kadmind daemon incorrectly accepts
authentications to two-component server principals whose first
component is a left substring of "kadmin" or whose realm is a left
prefix of the default realm.

An attacker who possess the key of a particularly named
principal (such as "kad/root") could impersonate any user to kadmind
and perform administrative actions as that user.

When kadmind receives a request using the RPCSEC_GSS authentication
flavor, it queries the GSS-API security context for the server
principal name and attempts to verify that it is a two-component
principal name where the first component is "kadmin", the second
component is not "history", and the realm is the default realm.

The validation function incorrectly uses strcmp() to compare the
length-counted principal name components against null-terminated C
strings for "kadmin", "history", and the default realm.  These
comparisons erroneously succeed for left substrings of the of the
desired C strings, so for example a first principal name component of
"ka" would be accepted.

kadmind can receive authentications to any server principal entry in
the Kerberos database (excluding entries with either the DISALLOW_SVR
or DISALLOW_ALL_TIX flags set).  If the database contains an
erroneously matching principal entry such as "ka/x", and an attacker
knows the key for that entry, the attacker can conduct an escalation
of privilege attack by forging tickets from any client principal name
to that server principal.  By picking a client principal name with
administrative privileges, the attacker could perform arbitrary
administrative operations on the Kerberos database.

Suggested patch to fix this issue, as well as CVE-2014-5352, CVE-2014-9421
and CVE-2014-9423 is attached to https://bugzilla.redhat.com/show_bug.cgi?id=1179856

Comment 1 Vasyl Kaigorodov 2015-01-07 17:03:04 UTC
Acknowledgements:

Red Hat would like to thank the MIT Kerberos project for reporting this issue.

Comment 2 Vasyl Kaigorodov 2015-01-12 15:18:43 UTC
According to MIT kadmind is vulnerable in all released versions of MIT krb5.

Comment 5 Vincent Danen 2015-02-03 21:19:48 UTC
External References:

http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2015-001.txt

Comment 6 Vincent Danen 2015-02-03 21:38:36 UTC
Created krb5 tracking bugs for this issue:

Affects: fedora-all [bug 1188869]

Comment 8 Vasyl Kaigorodov 2015-03-02 09:16:12 UTC
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Comment 9 errata-xmlrpc 2015-03-05 10:01:43 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:0439 https://rhn.redhat.com/errata/RHSA-2015-0439.html

Comment 11 Fedora Update System 2015-03-09 08:18:23 UTC
krb5-1.11.5-18.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Roland Mainz 2015-03-09 17:05:02 UTC
(In reply to Ganesh from comment #10)
> RHEL 6 is never mentioned on this Bug. Customer saw that these affect RHEL 6
> however. Do we have plan to release a fix for 6?

It's part of krb5-1.10.3-35.el6_6 (RHEL6.6.z) ...

Comment 13 Chris Cumbaa 2015-03-12 14:08:35 UTC
> This issue has been addressed in the following products:
> 
>   Red Hat Enterprise Linux 7
> 
> Via RHSA-2015:0439 https://rhn.redhat.com/errata/RHSA-2015-0439.html

It's been a week since the fix for RHEL7 was published and still no mention of RHEL6. Is it in-process?(In reply to errata-xmlrpc from comment #9)

Comment 14 Roland Mainz 2015-03-12 14:35:06 UTC
(In reply to Chris Cumbaa from comment #13)
> > This issue has been addressed in the following products:
> > 
> >   Red Hat Enterprise Linux 7
> > 
> > Via RHSA-2015:0439 https://rhn.redhat.com/errata/RHSA-2015-0439.html
> 
> It's been a week since the fix for RHEL7 was published and still no mention
> of RHEL6. Is it in-process?

See comment #12 ...

Comment 15 Fedora Update System 2015-03-12 16:33:45 UTC
krb5-1.12.2-14.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 errata-xmlrpc 2015-04-09 05:09:29 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2015:0794 https://rhn.redhat.com/errata/RHSA-2015-0794.html


Note You need to log in before you can comment on or make changes to this bug.