-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0008 -- AUSCERT ALERT
                               [UNIX/Linux]
   MIT Kerberos vulnerabilities allow remote compromise of key database
                              10 January 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              MIT Kerberos 5 versions 1.4 to 1.4.4 and 1.5 to 1.5.1
                      Other applications using MIT Kerberos 5 GSS-API or RPC libraries
Publisher:            US-CERT
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact:               Administrative Compromise
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-6143 CVE-2006-6144

Original Bulletin:    
  http://www.us-cert.gov/cas/techalerts/TA07-009B.html
  http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-002-rpc.txt
  http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2006-003-mechglue.txt

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

                        National Cyber Alert System

                 Technical Cyber Security Alert TA07-009B


MIT Kerberos Vulnerabilities

   Original release date: January 09, 2007
   Last revised: --
   Source: US-CERT


Systems Affected

     * MIT Kerberos

   Other products based on the GSS-API or the RPC libraries provided with
   MIT Kerberos may also be affected.


Overview

   The MIT Kerberos administration daemon contains two vulnerabilities
   that may allow a remote, unauthenticated attacker to execute arbitrary
   code.


I. Description

   We are aware of two vulnerabilities that affect the Kerberos
   administration daemon:

     * VU#481564 - Kerberos administration daemon fails to properly
       initialize function pointers
       The MIT Kerberos administration daemon contains a vulnerability in
       the way pointers are handled that may allow a remote,
       unauthenticated user to execute arbitrary code. Other server
       applications that utilize the RPC library provided with MIT
       Kerberos may also be affected. This vulnerability can be triggered
       by sending a specially crafted Kerberos packet to a vulnerable
       system. Further details about this vulnerability are available
       from the MIT Kerberos Development Team.

     * VU#831452 - Kerberos administration daemon may free uninitialized
       pointers
       The MIT Kerberos administration daemon contains a vulnerability
       that may allow an attacker to execute arbitary code. Other server
       applications that utilize the GSS-API library provided with MIT
       Kerberos may also be affected. Further details about this
       vulnerability are available from the MIT Kerberos Development
       Team.


II. Impact

   A remote, unauthenticated attacker may be able to execute arbitrary
   code resulting in the compromise of the Kerberos key database or cause
   a denial of service.


III. Solution

   These vulnerabilities are addressed in MIT krb5 Security Advisory
   2006-002 and MIT krb5 Security Advisory 2006-003. Patches for these
   issues are also included in those advisories.


IV. References

     * US-CERT Vulnerability Note VU#481564 -
       <http://www.kb.cert.org/vuls/id/481564>
     * US-CERT Vulnerability Note VU#831452 -
       <http://www.kb.cert.org/vuls/id/831452>
     * MIT krb5 Security Advisory 2006-002 -
       <http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt>
     * MIT krb5 Security Advisory 2006-003 -
       <http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-003-mechglue.txt>

 ____________________________________________________________________

   The most recent version of this document can be found at:

     <http://www.us-cert.gov/cas/techalerts/TA07-009B.html>
 ____________________________________________________________________

   Feedback can be directed to US-CERT Technical Staff. Please send
   email to <cert@cert.org> with "TA07-009B Feedback VU#481564" in the
   subject.
 ____________________________________________________________________

   For instructions on subscribing to or unsubscribing from this
   mailing list, visit <http://www.us-cert.gov/cas/signup.html>.
 ____________________________________________________________________

   Produced 2007 by US-CERT, a government organization.

   Terms of use:

     <http://www.us-cert.gov/legal.html>
 ____________________________________________________________________


Revision History

   January 09, 2007: Initial release

- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iQEVAwUBRaQNc+xOF3G+ig+rAQKaOQgAjOD7/KVse1tv1gn46WKWVJ4mPajTdn8z
2B7cO52KVKJ6cPvQCXb5Yhy0ljFOqbtZAHyQ/XzdP13CrrQC6ut32aQN+HRSEf3N
3/kwxMxl+QlKUQ97kG3c40XsNClMVDGvWsQj2LRFrzKpTjjPSag+Cdp0eAp0YVx/
6G3WR0HgjoIrfoYgVdqiIz5yeG0O2adLNmjoosDoxV4sro94JbB1iv+SHM+HNCR8
UNIj/kBukOlof0zHapPVofcjJBnxkkRfLrwb1CmrHU5QL6su1GJ4dohlYnnpDevf
NYAoVkr2wni8hjaJezK+jjlp9Q2cEEoRyEHLCS33Q0jOhvSCidXUwQ==
=Ac/A
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRaREjyh9+71yA2DNAQJQpwP+KEfbct+Ee8AghbRUORpqEMw5WVIN6EO5
o4hkIa4RpPLUj5ggET8yEUvVk77+heZr7jhayhG1SE0of6VNk0O+jfN5SkE9iqI3
qbW3UJoiUljbJEZAqi9RfnCNL/5KEgmMcEsVhtwXax3TZA3bvJA2iyzYC6TNik/S
AU7vpJuObmg=
=wafE
-----END PGP SIGNATURE-----