CERT Advisory CA-2000-06 Multiple Buffer Overflows in Kerberos Authenticated Services

SUMMARY

Serious buffer overrun vulnerabilities exist in many implementations of Kerberos 4, including implementations included for backwards compatibility in Kerberos 5 implementations. Other less serious buffer overrun vulnerabilities have also been discovered. ALL KNOWN KERBEROS 4 IMPLEMENTATIONS derived from MIT sources are believed to be vulnerable.

IMPACT

• A remote user may gain unauthorized root access to a machine running services authenticated with Kerberos 4.
• A remote user may gain unauthorized root access to a machine running krshd, regardless of whether the program is configured to accept Kerberos 4 authentication.
• A local user may gain unauthorized root access by exploiting v4rcp or ksu.

DETAILS

The MIT Kerberos Team has been made aware of a security vulnerability in the Kerberos 4 compatibility code contained within the MIT Kerberos 5 source distributions. This vulnerability consists of a buffer overrun in the krb_rd_req() function, which is used by essentially all Kerberos-authenticated services that use Kerberos 4 for authentication. It is possible for an attacker to gain root access over the network by exploiting this vulnerability.

An exploit is known to exist for the Kerberized Berkeley remote shell daemon (krshd) for at least the i386-Linux platform, and possibly others. The extent of distribution of this exploit is unknown at this time.

Other buffer overruns have been discovered as well, though with less far-reaching impact.

The existing exploit does not directly use the buffer overrun in krb_rd_req(); rather, it uses the buffer that was overrun by krb_rd_req() to exploit a second overrun in krb425_conv_principal(). The krb_rd_req() code itself might not be exploitable once the overrun in krb425_conv_principal() is repaired, though it is likely that some other method of exploit may be found that does not require that an overrun exist in krb425_conv_principal().

VULNERABLE DISTRIBUTIONS AND PROGRAMS

Source distributions which may contain vulnerable code include:

• MIT Kerberos 5 releases krb5-1.0.x, krb5-1.1, krb5-1.1.1
• MIT Kerberos 4 patch 10, and likely earlier releases as well
• KerbNet (Cygnus implementation of Kerberos 5)
• Cygnus Network Security (CNS -- Cygnus implementation of Kerberos 4)

Daemons or services that may call krb_rd_req() and are thus vulnerable to remote exploit include:

krshd
klogind (if accepting Kerberos 4 authentication)
telnetd (if accepting Kerberos 4 authentication)
ftpd (if accepting Kerberos 4 authentication)
rkinitd
kpopd

In addition, it is possible that the v4rcp program, which is usually installed setuid to root, may be exploited by a local user to gain root access by means of exploiting the krb_rd_req vulnerability.

The ksu program in some MIT Kerberos 5 releases has a vulnerability that may result in unauthorized local root access. This bug was fixed in krb5-1.1.1, as well as in krb5-1.0.7-beta1. Release krb5-1.1, as well as krb5-1.0.6 and earlier, are believed to be vulnerable.

There is an unrelated buffer overrun in the krshd that is distributed with at least the MIT Kerberos 5 source distributions. It is not known whether an exploit exists for this buffer overrun. It is also not known whether this buffer overrun is actually exploitable.

WORKAROUNDS

Certain daemons that are called from inetd may be safe from exploitation if their command line invocation is modified to exclude the use of Kerberos 4 for authentication. Please consult the manpages or other documentation for your Kerberos distribution in order to determine the correct command line for disabling Kerberos 4 authentication. Daemons for which this approach may work include:

krshd (*)
klogind
telnetd

(*) The krshd program may still be vulnerable to remote attack if Kerberos 4 authentication is disabled, due to the unrelated buffer overrun mentioned above. It is best to disable the krshd program completely until a patched version can be installed.

The v4rcp program should have its setuid permission removed, since it may be possible to perform a local exploit against it.

The krb5 ksu program should have its setuid permission removed, if it was not compiled from krb5-1.1.1, krb5-1.0.7-beta1, or later code. Merely replacing the ksu binary with one compiled from krb5-1.1.1 or krb5-1.0.7-beta1 should be safe, provided that it is not compiled with shared libraries (the vulnerability is related to some library bugs). If ksu was compiled with shared libraries, it may be best to install a new release that has the library bug fixed.

In the MIT Kerberos 5 releases, it may not be possible to disable Kerberos 4 authentication in the ftpd program. Note that only releases krb5-1.1 and later will have the ability to receive Kerberos 4 authentication.

FIXES

The best course of action is to patch the code in the krb4 library, in addition to patching the code in the krshd program. The following patches include some less essential patches that also affect buffer overruns in potentially vulnerable code, but for which exploits are somewhat more difficult to construct.

Please note that there are two sets of patches in this file that apply against identically named files in two different releases. You should separate out the patch set that is relevant to you prior to applying them; otherwise, you may inadvertently patch some files twice.

MIT will soon release krb5-1.2, which will have these changes incorporated.

PATCHES AGAINST krb5-1.0.x

The following are patches against 1.0.7-beta1 (roughly). The most critical ones are:

appl/bsd/krshd.c
lib/krb4/rd_req.c
lib/krb5/krb/conv_princ.c

The rest are not as important but you may wish to apply them anyway out of paranoia. These patches may apply with a little bit of fuzz against releases prior to krb5-1.0.7-beta1, but there likely have not been significant changes in the affected code. These patches may also apply against KerbNet. The lib/krb4/rd_req.c patch may also apply against CNS and MIT Kerberos 4.

[Patches to correct this issue in Kerberos version 5-1.0.x were included at this point in the MIT advisory. The CERT Coordination Center has made these patches available at the following link:

http://www.cert.org/advisories/CA-2000-06/mit_10x_patch.txt

-- CERT/CC]

PATCHES AGAINST krb5-1.1.1

The following are patches against 1.1.1. The most critical ones are:

appl/bsd/krshd.c
lib/krb4/rd_req.c
lib/krb5/krb/conv_princ.c

IMPORTANT NOTE: If you are upgrading to krb5-1.1.1 (or krb5-1.1, but we recommend krb5-1.1.1 if you are going to upgrade at all) and compile the source tree with the --without-krb4 option, then you will also want to install the patch to login.c that is also provided below.

The rest are not as important but you may wish to apply them anyway out of paranoia.

[Patches to correct this issue in Kerberos version 5-1.1.1 were included at this point in the MIT advisory. The CERT Coordination Center has made these patches available at the following link:

http://www.cert.org/advisories/CA-2000-06/mit_111_patch.txt

-- CERT/CC]

ACKNOWLEDGMENTS

Thanks to Jim Paris (MIT class of 2003) for pointing out the krb_rd_req() vulnerability.

Thanks to Nalin Dahyabhai of Redhat for pointing out some other buffer overruns and coming up with patches.