Bug 415361 - (CVE-2007-5972) CVE-2007-5972 krb5: double free in kdb lib
CVE-2007-5972 krb5: double free in kdb lib
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On:
  Show dependency treegraph
Reported: 2007-12-07 03:51 EST by Tomas Hoger
Modified: 2007-12-14 04:42 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-12-14 04:42:39 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Tomas Hoger 2007-12-07 03:51:55 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-5972 to the following vulnerability:

Double-free vulnerability in the krb5_def_store_mkey function in lib/kdb/kdb_default.c in MIT Kerberos 5 (krb5) 1.5 has unknown impact and remote authenticated attack vectors.  NOTE: the free operations occur in code that stores the krb5kdc master key, and thus the attacker must have privileges to store this key.


Comment 1 Mark J. Cox (Product Security) 2007-12-14 04:42:26 EST
MIT say 


This bug is a double-free (actually a double-fclose) bug which is not
a vulnerability due to inaccessibility to an attacker.  If the
fwrite() call in krb5_def_store_mkey() (in src/lib/kdb/kdb_default.c)
fails, the file pointer "kf" may have fclose() called on it twice.

   180      if ((fwrite((krb5_pointer) &enctype,
   181                  2, 1, kf) != 1) ||
   182          (fwrite((krb5_pointer) &key->length,
   183                  sizeof(key->length), 1, kf) != 1) ||
   184          (fwrite((krb5_pointer) key->contents,
   185                  sizeof(key->contents[0]), (unsigned) key->length, 
   186                  kf) != key->length)) {
   187          retval = errno;
   188          (void) fclose(kf);
   189      }
   190      if (fclose(kf) == EOF)
   191          retval = errno;

The relevant code stashes a KDC master key.  It is only run by
explicit action of a KDC administrator, who already has all the
privileges that exploiting this bug would gain.  A properly configured
KDC will have no unprivileged users having shell or other login
access; therefore, an unprivileged user cannot cause the fwrite()
failure necessary for triggering this bug.  Also, under normal
conditions, the code is run exactly once in the lifetime of a KDC: at
database creation time.

Note You need to log in before you can comment on or make changes to this bug.