Skip to Content.
Sympa Menu

sm-commit - [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (0192a51605abaa1ffd3469a06802b89a0f963aac)

sm-commit AT lists.ibiblio.org

Subject: Source Mage code commit list

List archive

Chronological Thread  
  • From: Ladislav Hagara <scm AT sourcemage.org>
  • To: sm-commit AT lists.ibiblio.org
  • Subject: [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (0192a51605abaa1ffd3469a06802b89a0f963aac)
  • Date: Sun, 11 Nov 2007 04:59:59 -0600

GIT changes to master grimoire by Ladislav Hagara <ladislav.hagara AT unob.cz>:

crypto/krb5/BUILD | 3
crypto/krb5/DETAILS | 4
crypto/krb5/HISTORY | 4
crypto/krb5/MITKRB5-SA-2007-006.txt | 294
------------------------------------
4 files changed, 6 insertions(+), 299 deletions(-)

New commits:
commit 0192a51605abaa1ffd3469a06802b89a0f963aac
Author: Ladislav Hagara <ladislav.hagara AT unob.cz>
Commit: Ladislav Hagara <ladislav.hagara AT unob.cz>

krb5 1.6.3

diff --git a/crypto/krb5/BUILD b/crypto/krb5/BUILD
index d585d01..14d1206 100755
--- a/crypto/krb5/BUILD
+++ b/crypto/krb5/BUILD
@@ -6,9 +6,6 @@ fi

cd $SPELL-$VERSION/src &&

-# Kerberos Security Advisories
-patch -p1 < $SCRIPT_DIRECTORY/MITKRB5-SA-2007-006.txt &&
-
./configure --enable-dns-for-kdc \
--enable-dns-for-realm \
--infodir=/usr/share/info \
diff --git a/crypto/krb5/DETAILS b/crypto/krb5/DETAILS
index 51dd835..c59075c 100755
--- a/crypto/krb5/DETAILS
+++ b/crypto/krb5/DETAILS
@@ -1,10 +1,10 @@
SPELL=krb5
- VERSION=1.6.2
+ VERSION=1.6.3
SOURCE=$SPELL-$VERSION-signed.tar
SOURCE_RAW=$SPELL-$VERSION.tar.gz
SOURCE_DIRECTORY=$BUILD_DIRECTORY/$SPELL-$VERSION
SOURCE_URL[0]=http://web.mit.edu/kerberos/www/dist/krb5/1.6/$SOURCE
-
SOURCE_HASH=sha512:d9ebb5fd4300e3a56f5852f29db43eae7ebdf16d5b62406730309a05ca16f27b395dd2542288c5a6508aecf1016634dfce781e514b47f75fb445ece8479fe88d
+
SOURCE_HASH=sha512:5d1e00e54ddfa8cdba3e5ea6a78cccb1abf79433e24f3fcba88c812a8a630d907cab6b89adde73298cfc55f2fac6222d5cf3b836d0fe31268a57e4fde0fb8c27
WEB_SITE=http://web.mit.edu/kerberos/www/
ENTERED=20020215

LICENSE[0]=http://web.mit.edu/kerberos/www/krb5-1.6/krb5-1.6/doc/krb5-install.html#Copyright
diff --git a/crypto/krb5/HISTORY b/crypto/krb5/HISTORY
index e228521..dd94714 100644
--- a/crypto/krb5/HISTORY
+++ b/crypto/krb5/HISTORY
@@ -1,3 +1,7 @@
+2007-11-11 Ladislav Hagara <hgr AT vabo.cz>
+ * DETAILS: 1.6.3
+ * BUILD, MITKRB5-SA-2007-006.txt: removed patch
+
2007-09-12 Ladislav Hagara <hgr AT vabo.cz>
* DETAILS: SECURITY_PATCH=5, CVE-2007-3999, CVE-2007-4000
* BUILD, MITKRB5-SA-2007-006.txt: added security patch
diff --git a/crypto/krb5/MITKRB5-SA-2007-006.txt
b/crypto/krb5/MITKRB5-SA-2007-006.txt
deleted file mode 100644
index 979f9ed..0000000
--- a/crypto/krb5/MITKRB5-SA-2007-006.txt
+++ /dev/null
@@ -1,294 +0,0 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
- MIT krb5 Security Advisory 2007-006
-
-Original release: 2007-09-04
-Last update: 2007-09-05
-
-Topic: kadmind RPC lib buffer overflow, uninitialized pointer
-
-[CVE-2007-3999/VU#883632]
-RPC library buffer overflow
-
-CVSSv2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:OF/RC:C
-
-CVSSv2 Base Score: 10
-
-Access Vector: Network
-Access Complexity: Low
-Authentication: None
-Confidentiality Impact: Complete
-Integrity Impact: Complete
-Availability Impact: Complete
-
-CVSSv2 Temporal Score: 7.8
-
-Exploitability: Proof-of-Concept
-Remediation Level: Official Fix
-Report Confidence: Confirmed
-
-[CVE-2007-4000/VU#377544]
-kadmind uninitialized pointer
-
-CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C
-
-See DETAILS for the expanded CVSSv2 metrics for this vulnerability.
-
-SUMMARY
-=======
-
-This advisory concerns two vulnerabilities. CVE-2007-3999 is much
-easier to exploit than CVE-2007-4000.
-
-[CVE-2007-3999]
-
-The MIT krb5 Kerberos administration daemon (kadmind) is vulnerable to
-a stack buffer overflow in the RPCSEC_GSS authentication flavor of the
-RPC library. Third-party applications using the RPC library provided
-with MIT krb5 may also be affected.
-
-We have received a proof-of-concept exploit that does not appear to
-execute malicious code, and we believe that this exploit is not
-publicly circulated.
-
-This is a bug in the RPC library in MIT krb5. It is not a bug in the
-Kerberos protocol.
-
-[CVE-2007-4000]
-
-The MIT krb5 Kerberos administration daemon (kadmind) can write data
-through an uninitialized pointer. We know of no working exploit code
-for this vulnerability, and do not believe that any exploit code for
-this vulnerability is circulating.
-
-This is a bug in the kadmind in MIT krb5. It is not a bug in the
-Kerberos protocol.
-
-IMPACT
-======
-
-[CVE-2007-3999] An unauthenticated remote user may be able to cause a
-host running kadmind to execute arbitrary code.
-
-[CVE-2007-4000] An authenticated user with "modify policy" privilege
-may be able to cause a host running kadmind to execute arbitrary code.
-
-Successful exploitation of either vulnerability can compromise the
-Kerberos key database and host security on the KDC host. (kadmind
-typically runs as root.) Unsuccessful exploitation attempts will
-likely result in kadmind crashing.
-
-Third-party applications calling the RPC library provided with MIT
-krb5 may be vulnerable to CVE-2007-3999.
-
-AFFECTED SOFTWARE
-=================
-
-[CVE-2007-3999]
-
-* kadmind in MIT releases krb5-1.4 through krb5-1.6.2
-
-* third-party RPC server programs linked against the RPC library
- included in MIT releases krb5-1.4 through krb5-1.6.2
-
-* MIT releases prior to krb5-1.4 did not contain the vulnerable code
-
-[CVE-2007-4000]
-
-* kadmind in MIT releases krb5-1.5 through krb5-1.6.2
-
-* MIT releases prior to krb5-1.5 did not contain the vulnerable code
-
-FIXES
-=====
-
-* The patch for CVE-2007-3999 has been revised; the patch originally
- released for svc_auth_gss.c allowed a 32-byte overflow. Depending
- on the compilation environment and machine architecture, this may or
- may not be a significant continued vulnerability. The new patch
- below correctly checks the buffer length.
-
-* The upcoming krb5-1.6.3 release, as well as the upcoming krb5-1.5.5
- maintenance release, will contain fixes for this vulnerability.
-
-Prior to that release you may apply the following patch. Note that
-releases prior to krb5-1.5 will not need the svr_policy.c patch.
-
-*** src/lib/kadm5/srv/svr_policy.c (revision 20254)
-- --- src/lib/kadm5/srv/svr_policy.c (local)
-***************
-*** 211,218 ****
- if((mask & KADM5_POLICY))
- return KADM5_BAD_MASK;
-
-! ret = krb5_db_get_policy(handle->context, entry->policy, &p, &cnt);
-! if( ret && (cnt==0) )
- return KADM5_UNK_POLICY;
-
- if ((mask & KADM5_PW_MAX_LIFE))
-- --- 211,219 ----
- if((mask & KADM5_POLICY))
- return KADM5_BAD_MASK;
-
-! if ((ret = krb5_db_get_policy(handle->context, entry->policy, &p,
&cnt)))
-! return ret;
-! if (cnt != 1)
- return KADM5_UNK_POLICY;
-
- if ((mask & KADM5_PW_MAX_LIFE))
-*** src/lib/rpc/svc_auth_gss.c (revision 20474)
-- --- src/lib/rpc/svc_auth_gss.c (local)
-***************
-*** 355,360 ****
-- --- 355,369 ----
- memset(rpchdr, 0, sizeof(rpchdr));
-
- /* XXX - Reconstruct RPC header for signing (from xdr_callmsg). */
-+ oa = &msg->rm_call.cb_cred;
-+ if (oa->oa_length > MAX_AUTH_BYTES)
-+ return (FALSE);
-+
-+ /* 8 XDR units from the IXDR macro calls. */
-+ if (sizeof(rpchdr) < (8 * BYTES_PER_XDR_UNIT +
-+ RNDUP(oa->oa_length)))
-+ return (FALSE);
-+
- buf = (int32_t *)(void *)rpchdr;
- IXDR_PUT_LONG(buf, msg->rm_xid);
- IXDR_PUT_ENUM(buf, msg->rm_direction);
-***************
-*** 362,368 ****
- IXDR_PUT_LONG(buf, msg->rm_call.cb_prog);
- IXDR_PUT_LONG(buf, msg->rm_call.cb_vers);
- IXDR_PUT_LONG(buf, msg->rm_call.cb_proc);
-- - oa = &msg->rm_call.cb_cred;
- IXDR_PUT_ENUM(buf, oa->oa_flavor);
- IXDR_PUT_LONG(buf, oa->oa_length);
- if (oa->oa_length) {
-- --- 371,376 ----
-
- This patch is also available at
-
- http://web.mit.edu/kerberos/advisories/2007-006-patch.txt
-
- A PGP-signed patch is available at
-
- http://web.mit.edu/kerberos/advisories/2007-006-patch.txt.asc
-
-REFERENCES
-==========
-
-This announcement is posted at:
-
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-006.txt
-
-This announcement and related security advisories may be found on the
-MIT Kerberos security advisory page at:
-
- http://web.mit.edu/kerberos/advisories/index.html
-
-The main MIT Kerberos web page is at:
-
- http://web.mit.edu/kerberos/index.html
-
-CVSSv2:
-
- http://www.first.org/cvss/cvss-guide.html
- http://nvd.nist.gov/cvss.cfm?calculator&adv&version=2
-
-CVE: CVE-2007-3999
-http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999
-
-CERT: VU#883632
-http://www.kb.cert.org/vuls/id/883632
-
-CVE: CVE-2007-4000
-http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4000
-
-CERT: VU#377544
-http://www.kb.cert.org/vuls/id/377544
-
-ACKNOWLEDGMENTS
-===============
-
-Thanks to Kevin Coffman (UMich), Will Fiveash (Sun), and Nico Williams
-(Sun) for discovering the bug in the initial CVE-2007-3999 patch and
-for help with developing the revised patch for CVE-2007-3999.
-
-CVE-2007-3999 was discovered by Tenable Network Security and reported
-to MIT Kerberos Team by the Zero Day Initiative (ZDI) of the
-TippingPoint division of 3Com.
-
-CVE-2007-4000 was discovered by Garrett Wollman of MIT CSAIL.
-
-DETAILS
-=======
-
-[CVE-2007-3999]
-
-The implementation of the RPCSEC_GSS authentication flavor copies
-untrusted data having an inadequately-validated length into a buffer
-on the stack. In the function svcauth_gss_validate() in
-src/lib/rpc/svc_auth_gss.c, which authenticates the incoming RPC
-message, a memcpy() invocation copies a number of bytes into the
-128-byte stack buffer "rpchdr". The length provided to this memcpy()
-invocation comes from the RPC header and may be maliciously chosen.
-The invocation of xdr_callmsg(), which provides the decoded rpc_msg
-structure used by svcauth_gss_validate(), ensures that the provided
-length does not exceed MAX_AUTH_BYTES, which is 400, but destination
-buffer is smaller than this size, and can be trivially overflowed.
-
-The vulnerable code executes prior to the completion of authentication
-of the RPC message, and therefore requires no authentication to
-exploit.
-
-Exploitation of stack buffer overflows is trivial on many platforms.
-
-[CVE-2007-4000]
-
-CVSSv2 Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C
-
-CVSSv2 Base Score: 7.1
-
-Access Vector: Network
-Access Complexity: High
-Authentication: Single
-Confidentiality Impact: Complete
-Integrity Impact: Complete
-Availability Impact: Complete
-
-CVSSv2 Temporal Score: 5.6
-
-Exploitability: Proof-of-Concept
-Remediation Level: Official Fix
-Report Confidence: Confirmed
-
-The function kadm5_modify_policy_internal() in
-src/lib/kadm5/srv/svr_policy.c, does not check return values from
-krb5_db_get_policy() correctly. When the policy does not exist,
-krb5_db_get_policy() returns zero but sets the count retrieved records
-to zero without initializing the output pointer. Subsequent code in
-kadm5_modify_policy_internal() can attempt to write data through this
-pointer, causing memory corruption.
-
-This vulnerability was not present in MIT releases prior to krb5-1.5.
-In the krb5-1.5 release, changes related to the implementation of the
-Database Abstraction Layer introduced this vulnerability.
-
-REVISION HISTORY
-================
-
-2007-09-05 CVE-2007-3999 patch revised due to 32-byte overflow
-2007-09-04 original release
-
-Copyright (C) 2007 Massachusetts Institute of Technology
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.6 (SunOS)
-
-iQCVAwUBRt8QzKbDgE/zdoE9AQKdeAQAsXljmcOJpFHYISth3PZcVWQrrWI4u9PH
-F4CAC+3z9xd5KnOHAqqmxpK5XSDX0P9MCdibOYA/WG46U410pCNAkqV0RapUnivO
-fcU82CvXLDGoz4Z2+ldZpUYmL3mZ6ydTLutBAsz1XkkAILYfaP14+x0OXyyiMgeM
-tH18QwV9ccI=
-=TRxx
------END PGP SIGNATURE-----



  • [SM-Commit] GIT changes to master grimoire by Ladislav Hagara (0192a51605abaa1ffd3469a06802b89a0f963aac), Ladislav Hagara, 11/11/2007

Archive powered by MHonArc 2.6.24.

Top of Page