Bug 838012 - (CVE-2012-1015) CVE-2012-1015 krb5: KDC daemon crash via free() of an uninitialized pointer
CVE-2012-1015 krb5: KDC daemon crash via free() of an uninitialized pointer
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
high Severity high
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 839859 839860 844777
Blocks: 838017
  Show dependency treegraph
Reported: 2012-07-06 02:34 EDT by Huzaifa S. Sidhpurwala
Modified: 2015-11-24 10:06 EST (History)
8 users (show)

See Also:
Fixed In Version: krb5-1.9.5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2012-07-31 17:44:26 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Huzaifa S. Sidhpurwala 2012-07-06 02:34:23 EDT
The MIT krb5 KDC (Key Distribution Center) daemon can free an uninitialized pointer while processing an unusual AS-REQ, corrupting the process heap and possibly causing the daemon to abnormally terminate.
An attacker could use this vulnerability to execute malicious code, but exploiting frees of uninitialized pointers to execute code is believed to be difficult. It is possible that a legitimate client that is misconfigured in an unusual way could trigger this vulnerability.

Note: Current glibc protections will cause invalid pointer frees to be reduced to crash only.

The KDC in releases krb5-1.8 and later is vulnerable to this flaw.

Reference: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt
Patch: http://web.mit.edu/kerberos/advisories/2012-001-patch.txt

Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Emmanuel Bouillon (NCI Agency) as the original reporter of the flaw.
Comment 4 Huzaifa S. Sidhpurwala 2012-07-06 04:45:27 EDT
This issue does not affect the version of krb5 package as shipped with Red Hat Enterprise Linux 5.

This issue affects the version of krb5 package as shipped with Red Hat Enterprise Linux 6.

This issue affects the version of krb5 package as shipped with Fedora-16 and Fedora-17.
Comment 8 Vincent Danen 2012-07-31 12:29:18 EDT

Not vulnerable. This issue did not affect the versions of krb5 as shipped with Red Hat Enterprise Linux 5.
Comment 9 Vincent Danen 2012-07-31 14:23:59 EDT
External Reference:

Comment 10 Vincent Danen 2012-07-31 14:26:01 EDT
Created krb5 tracking bugs for this issue

Affects: fedora-all [bug 844777]
Comment 11 errata-xmlrpc 2012-07-31 14:57:00 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:1131 https://rhn.redhat.com/errata/RHSA-2012-1131.html
Comment 12 Tims-Linux 2012-08-02 04:34:55 EDT
I'm using RHEL 6.3 and version is 2.6.32-279.el6.x86_64. All my updates are up to date. Getting an error while trying to update below packages;
  krb5-devel-1.9-33.el6_3.2 (x86_64)
  krb5-libs-1.9-33.el6_3.2 (x86_64)

Here is message from Software update application;
failure: repodata/4a42f31b073aa87af77c0b072119d6ebb7c390d693250acf851eea978c565fe6-filelists.sqlite.bz2 from epel-debuginfo: [Errno 256] No more mirrors to try.
Comment 13 Tomas Hoger 2012-08-02 04:55:35 EDT
This issue seems completely unrelated to this update.  Temporary disabling repository (--disablerepo epel-debuginfo option to yum) can help, or you may prefer to disable the repo or mark it as skip_if_unavailable in the relevant repo file in /etc/yum.repos.d/, see yum.conf manual page for details.

If you need further assistance with doing such changes, please contact Red Hat Support: https://access.redhat.com/support/
Comment 14 Tims-Linux 2012-08-02 05:34:30 EDT
Thanks, it worked by disabling debuginfo repository
Comment 17 Jan Lieskovsky 2013-04-29 04:31:40 EDT
Kerberos 5 release krb5-1.9.5 announcement:

Note You need to log in before you can comment on or make changes to this bug.