Signature Detail

APP: Kerberos Denial of Service over TCP (2)

This signature detects a heap corruption attack in the MIT Kerberos V5 Key Distribution Center (KDC) implementation. The vulnerability is caused from improper handling of an error case. An unauthenticated remote attacker can leverage this vulnerability to cause a denial of service or to execute arbitrary code, potentially compromising an entire Kerberos realm.

Extended Description

The Kerberos 5 Key Distribution Center (KDC) implementation of Kerberos is affected by a remote denial-of-service vulnerability. This issue arises because the application tries to free uninitialized memory at a random address when handling a remote request over TCP. Specifically, the vulnerability arises when the application handles a principle name consisting of zero components. All MIT Kerberos 5 releases up to and including krb5-1.4.1 are vulnerable. Third-party application servers employing Kerberos 5 may be affected as well.

Affected Products

• Apple mac_os_x 10.4.2
• Apple mac_os_x_server 10.4.2
• Conectiva linux 10.0.0
• Conectiva linux 9.0.0
• Debian linux 3.0.0
• Debian linux 3.0.0 Alpha
• Debian linux 3.0.0 Arm
• Debian linux 3.0.0 Hppa
• Debian linux 3.0.0 Ia-32
• Debian linux 3.0.0 Ia-64
• Debian linux 3.0.0 M68k
• Debian linux 3.0.0 Mips
• Debian linux 3.0.0 Mipsel
• Debian linux 3.0.0 Ppc
• Debian linux 3.0.0 S/390
• Debian linux 3.0.0 Sparc
• Debian linux 3.1.0
• Debian linux 3.1.0 Alpha
• Debian linux 3.1.0 Amd64
• Debian linux 3.1.0 Arm
• Debian linux 3.1.0 Hppa
• Debian linux 3.1.0 Ia-32
• Debian linux 3.1.0 Ia-64
• Debian linux 3.1.0 M68k
• Debian linux 3.1.0 Mips
• Debian linux 3.1.0 Mipsel
• Debian linux 3.1.0 Ppc
• Debian linux 3.1.0 S/390
• Debian linux 3.1.0 Sparc
• Gentoo linux
• Ibm dce 3.2.0 for AIX
• Mandriva corporate_server 2.1.0
• Mandriva corporate_server 2.1.0 X86 64
• Mandriva corporate_server 3.0.0
• Mandriva corporate_server 3.0.0 X86 64
• Mandriva linux_mandrake 10.0.0
• Mandriva linux_mandrake 10.0.0 amd64
• Mandriva linux_mandrake 10.1.0
• Mandriva linux_mandrake 10.1.0 X86 64
• Mandriva linux_mandrake 10.2.0
• Mandriva linux_mandrake 10.2.0 X86 64
• Mandriva multi_network_firewall 2.0.0
• Mit kerberos_5 5.0.0 -1.0.X
• Mit kerberos_5 5.0.0 -1.1
• Mit kerberos_5 5.0.0 -1.1.1
• Mit kerberos_5 5.0.0 -1.2Beta1
• Mit kerberos_5 5.0.0 -1.2Beta2
• Mit kerberos_5 5.0.0 -1.3.3
• Mit kerberos_5 5.0.0 -1.3.4
• Mit kerberos_5 5.0.0 -1.3.5
• Mit kerberos_5 5.0.0 -1.3.6
• Mit kerberos_5 5.0.0 -1.4
• Mit kerberos_5 5.0.0 -1.4.1
• Red_hat fedora Core3
• Red_hat fedora Core4
• Sgi propack 3.0.0 SP6
• Sun seam 1.0.0
• Sun seam 1.0.1
• Sun seam 1.0.2
• Sun solaris 10 Sparc
• Sun solaris 10 X86
• Sun solaris 8 Sparc
• Sun solaris 8 X86
• Sun solaris 9 Sparc
• Sun solaris 9 X86
• Sun solaris 9 X86 Update 2
• Suse linux_personal 9.3.0
• Suse linux_personal 9.3.0 X86 64
• Suse linux_professional 9.3.0
• Suse linux_professional 9.3.0 X86 64
• Trustix secure_enterprise_linux 2.0.0
• Trustix secure_linux 2.2.0
• Trustix secure_linux 3.0.0
• Turbolinux appliance_server 1.0.0 Hosting Edition
• Turbolinux appliance_server 1.0.0 Workgroup Edition
• Turbolinux home
• Turbolinux turbolinux_desktop 10.0.0
• Turbolinux turbolinux_server 10.0.0
• Turbolinux turbolinux_server 8.0.0
• Ubuntu ubuntu_linux 4.1.0 Ia32
• Ubuntu ubuntu_linux 4.1.0 Ia64
• Ubuntu ubuntu_linux 4.1.0 Ppc
• Ubuntu ubuntu_linux 5.0.0 4 Amd64
• Ubuntu ubuntu_linux 5.0.0 4 I386
• Ubuntu ubuntu_linux 5.0.0 4 Powerpc

References

• BugTraq: 14240
• CVE: CVE-2005-1174
• URL: http://web.mit.edu/kerberos/advisories/2005-002-patch_1.4.1.txt