SUMMARY
Serious buffer overrun vulnerabilities exist in many
implementations of Kerberos 4, including implementations included for
backwards compatibility in Kerberos 5 implementations. Other less
serious buffer overrun vulnerabilities have also been discovered. ALL
KNOWN KERBEROS 4 IMPLEMENTATIONS derived from MIT sources are believed
to be vulnerable.
IMPACT
- A remote user may gain unauthorized root access to a machine
running services authenticated with Kerberos 4.
- A remote user may gain unauthorized root access to a machine
running krshd, regardless of whether the program is configured to
accept Kerberos 4 authentication.
- A local user may gain unauthorized root access by exploiting v4rcp
or ksu.
DETAILS
The MIT Kerberos Team has been made aware of a security
vulnerability in the Kerberos 4 compatibility code contained within
the MIT Kerberos 5 source distributions. This vulnerability consists
of a buffer overrun in the krb_rd_req() function, which is used by
essentially all Kerberos-authenticated services that use Kerberos 4
for authentication. It is possible for an attacker to gain root
access over the network by exploiting this vulnerability.
An exploit is known to exist for the Kerberized Berkeley remote
shell daemon (krshd) for at least the i386-Linux platform, and
possibly others. The extent of distribution of this exploit is
unknown at this time.
Other buffer overruns have been discovered as well, though with
less far-reaching impact.
The existing exploit does not directly use the buffer overrun in
krb_rd_req(); rather, it uses the buffer that was overrun by
krb_rd_req() to exploit a second overrun in krb425_conv_principal().
The krb_rd_req() code itself might not be exploitable once the overrun
in krb425_conv_principal() is repaired, though it is likely that some
other method of exploit may be found that does not require that an
overrun exist in krb425_conv_principal().
VULNERABLE DISTRIBUTIONS AND PROGRAMS
Source distributions which may contain vulnerable code include:
- MIT Kerberos 5 releases krb5-1.0.x, krb5-1.1, krb5-1.1.1
- MIT Kerberos 4 patch 10, and likely earlier releases as well
- KerbNet (Cygnus implementation of Kerberos 5)
- Cygnus Network Security (CNS -- Cygnus implementation of Kerberos 4)
Daemons or services that may call krb_rd_req() and are thus
vulnerable to remote exploit include:
-
krshd
klogind (if accepting Kerberos 4 authentication)
telnetd (if accepting Kerberos 4 authentication)
ftpd (if accepting Kerberos 4 authentication)
rkinitd
kpopd
In addition, it is possible that the v4rcp program, which is
usually installed setuid to root, may be exploited by a local user to
gain root access by means of exploiting the krb_rd_req vulnerability.
The ksu program in some MIT Kerberos 5 releases has a vulnerability
that may result in unauthorized local root access. This bug was fixed
in krb5-1.1.1, as well as in krb5-1.0.7-beta1. Release krb5-1.1, as
well as krb5-1.0.6 and earlier, are believed to be vulnerable.
There is an unrelated buffer overrun in the krshd that is
distributed with at least the MIT Kerberos 5 source distributions. It
is not known whether an exploit exists for this buffer overrun. It is
also not known whether this buffer overrun is actually exploitable.
WORKAROUNDS
Certain daemons that are called from inetd may be safe from
exploitation if their command line invocation is modified to exclude
the use of Kerberos 4 for authentication. Please consult the manpages
or other documentation for your Kerberos distribution in order to
determine the correct command line for disabling Kerberos 4
authentication. Daemons for which this approach may work include:
-
krshd (*)
klogind
telnetd
(*) The krshd program may still be vulnerable to remote attack if
Kerberos 4 authentication is disabled, due to the unrelated buffer
overrun mentioned above. It is best to disable the krshd program
completely until a patched version can be installed.
The v4rcp program should have its setuid permission removed, since
it may be possible to perform a local exploit against it.
The krb5 ksu program should have its setuid permission removed, if
it was not compiled from krb5-1.1.1, krb5-1.0.7-beta1, or later code.
Merely replacing the ksu binary with one compiled from krb5-1.1.1 or
krb5-1.0.7-beta1 should be safe, provided that it is not compiled with
shared libraries (the vulnerability is related to some library bugs).
If ksu was compiled with shared libraries, it may be best to install a
new release that has the library bug fixed.
In the MIT Kerberos 5 releases, it may not be possible to disable
Kerberos 4 authentication in the ftpd program. Note that only
releases krb5-1.1 and later will have the ability to receive Kerberos
4 authentication.
FIXES
The best course of action is to patch the code in the krb4 library,
in addition to patching the code in the krshd program. The following
patches include some less essential patches that also affect buffer
overruns in potentially vulnerable code, but for which exploits are
somewhat more difficult to construct.
Please note that there are two sets of patches in this file that
apply against identically named files in two different releases. You
should separate out the patch set that is relevant to you prior to
applying them; otherwise, you may inadvertently patch some files
twice.
MIT will soon release krb5-1.2, which will have these changes
incorporated.
PATCHES AGAINST krb5-1.0.x
The following are patches against 1.0.7-beta1 (roughly). The most
critical ones are:
-
appl/bsd/krshd.c
lib/krb4/rd_req.c
lib/krb5/krb/conv_princ.c
The rest are not as important but you may wish to apply them anyway
out of paranoia. These patches may apply with a little bit of fuzz
against releases prior to krb5-1.0.7-beta1, but there likely have not
been significant changes in the affected code. These patches may also
apply against KerbNet. The lib/krb4/rd_req.c patch may also apply
against CNS and MIT Kerberos 4.
