Bug 250973 (CVE-2007-3999) - CVE-2007-3999 krb5 RPC library buffer overflow
Summary: CVE-2007-3999 krb5 RPC library buffer overflow
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2007-3999
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 250997 250998 265001 265021 265041 265061 294901 294911 294921 294931 362091 362101 362111 362121
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-08-06 09:19 UTC by Mark J. Cox
Modified: 2019-09-29 12:20 UTC (History)
4 users (show)

Fixed In Version: 0.1.7-15.fc8
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-03-06 16:35:48 UTC


Attachments (Terms of Use)
proposed patch from MIT (755 bytes, patch)
2007-08-06 09:24 UTC, Mark J. Cox
no flags Details | Diff
Updated patch from MIT (926 bytes, patch)
2007-09-12 13:10 UTC, Josh Bressers
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0858 normal SHIPPED_LIVE Important: krb5 security update 2007-09-07 07:27:07 UTC
Red Hat Product Errata RHSA-2007:0913 normal SHIPPED_LIVE Important: nfs-utils-lib security update 2008-01-08 17:37:53 UTC
Red Hat Product Errata RHSA-2007:0951 normal SHIPPED_LIVE Important: nfs-utils-lib security update 2007-10-02 20:55:13 UTC

Description Mark J. Cox 2007-08-06 09:19:50 UTC
MIT notified us of kadmind RPC lib buffer overflow, uninitialized pointer.  Will
be public on 04 September 2007, at 14:00 US/Eastern time.

This issue has not been triaged as it may well affect recent RHEL distributions
with a different severity (flaw type is likely caught by fortify_source)

Comment 3 Mark J. Cox 2007-08-06 09:24:04 UTC
Created attachment 160738 [details]
proposed patch from MIT

Comment 7 Tomas Hoger 2007-08-28 06:13:55 UTC
Update from MIT Kerberos team:

We have discovered that the server-side code in nfs-utils is also
vulnerable to CVE-2007-3999.  If you are distributing nfs-utils or
some derivative, you may care about this.  According to Kevin Coffman
of the University of Michigan, nfs-utils is probably not vulnerable
because it does not actually execute any server-side RPC code.  We are
working to confirm this assertion, but note that third-party server
applications that link with the RPC library in nfs-utils may be
vulnerable to CVE-2007-3999.


Comment 9 Mark J. Cox 2007-09-04 18:11:14 UTC
now public at http://web.mit.edu/Kerberos/advisories/
removing embargo

Comment 10 Josh Bressers 2007-09-12 13:10:43 UTC
Created attachment 193381 [details]
Updated patch from MIT

Comment 15 Fedora Update System 2008-01-26 14:55:40 UTC
libtirpc-0.1.7-15.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update libtirpc'.  You can provide feedback for this update here: http://admin.fedoraproject.org/F8/FEDORA-2008-1017

Comment 16 Luke Macken 2008-01-26 18:15:12 UTC
The above url should read
https://admin.fedoraproject.org/updates/F8/FEDORA-2008-1017

Comment 17 Fedora Update System 2008-03-06 16:35:43 UTC
libtirpc-0.1.7-15.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.