Bug 576011 – CVE-2010-0629 krb5: kadmind use-after-free remote crash (MITKRB5-SA-2010-003)

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 576011 - (CVE-2010-0629) CVE-2010-0629 krb5: kadmind use-after-free remote crash (MITKRB5-SA-2010-003)

Summary:	CVE-2010-0629 krb5: kadmind use-after-free remote crash (MITKRB5-SA-2010-003)

Status:	CLOSED ERRATA

Aliases:	CVE-2010-0629

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	high Severity high
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:	http://web.mit.edu/kerberos/www/advis...
Whiteboard:	impact=important,source=redhat,report...
Keywords:	Security

Depends On:	578185 578186
Blocks:
	Show dependency tree / graph

Reported:	2010-03-22 21:21 EDT by Vincent Danen
Modified:	2016-03-04 06:09 EST (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2010-04-09 02:16:45 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2010:0343	normal	SHIPPED_LIVE	Important: krb5 security and bug fix update	2010-04-06 19:07:55 EDT

Groups: None (edit)

Description Vincent Danen 2010-03-22 21:21:18 EDT

Brian Atkisson reported that the kadmind server on a master KDC was crashing due to certain requests from kadmin clients from krb5 1.8.  This is due to check_handle() in server_stubs.c returning a failure if the clients tries to start with API version 3.  The server frees the handle, and then attempts to dereference the handle when calling krb5_get_error_message(), at which point kadmind will usually segfault and crash.

This has already been fixed upstream in changeset 20485:

http://src.mit.edu/fisheye/changelog/krb5/?cs=20485

Comment 2 Vincent Danen 2010-03-22 22:08:28 EDT

This was previously reported to Debian:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567052

and upstream:

http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=5998

By the looks of the upstream reports, this is just a denial of service, nothing more.  It was also assigned CVE-2010-0629.

Comment 10 Vincent Danen 2010-03-23 15:50:48 EDT

Looking at the commit, this would have been fixed in 1.6.4, which means Fedora 11 is vulnerable.

This issue also does not affect Red Hat Enterprise Linux 4 or earlier as the variable in question (handle) isn't referenced after it is freed.

This issue does affect Red Hat Enterprise Linux 5.

Comment 13 Jan Lieskovsky 2010-04-06 17:01:56 EDT

Public via:
  [1] http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2010-003.txt

Comment 14 errata-xmlrpc 2010-04-06 19:07:58 EDT

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0343 https://rhn.redhat.com/errata/RHSA-2010-0343.html

Comment 15 Fedora Update System 2010-04-07 02:47:45 EDT

krb5-1.6.3-29.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/krb5-1.6.3-29.fc11

Comment 16 Fedora Update System 2010-04-08 21:42:00 EDT

krb5-1.6.3-29.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.