Vulnerability Bulletins |
Ejecución de código en Kerberos |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software |
Kerberos 5 1.4 <= 1.4.4 Kerberos 5 1.5 <= 1.5.1 |
Description |
|
|
Se han descubierto múltiples vulnerabilidades en el demonio de administración de Kerberos. Las vulnerabilidades son descritas a continuación. - CVE-2006-6143: Se ha descubierto una vulnerabilidad en la librería RPC en Kerberos 5 1.4 hasta 1.4.4, y en la versión 1.5 hasta 1.5.1, que es utilizada por el demonio de administración de Kerberos (kadmind) y otros productos. La vulnerabilidad reside en que hace una llamada a un puntero hacia una función no inicializado en memoria. Un atacante remoto podría causar una denegación de servicio y posiblemente ejecutar código arbitrario mediante métodos no especificados. - CVE-2006-6144: Se ha descubierto una vulnerabilidad en la interfaz abstracta "mechglue" de la librería GSS-API para Kerberos 5 1.5 hasta la versión 1.5.1, que es usada por el demonio de administración de Kerberos (kadmind) y otros productos. Un atacante remoto podría causar una denegación de servicio mediante métodos no especificados que causarian que "mechglue" liberase memoria de punteros no inicializados. |
|
Solution |
|
|
Actualización de software Mandriva Mandriva Linux 2006 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/ftp-client-krb5-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/ftp-server-krb5-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/krb5-server-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/krb5-workstation-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/libkrb53-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/libkrb53-devel-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/telnet-client-krb5-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/i586/telnet-server-krb5-1.4.2-1.2.20060mdk.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/krb5-1.4.2-1.2.20060mdk.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/ftp-client-krb5-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/ftp-server-krb5-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/krb5-server-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/krb5-workstation-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/lib64krb53-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/lib64krb53-devel-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/telnet-client-krb5-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/x86_64/telnet-server-krb5-1.4.2-1.2.20060mdk.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2006.0/SRPMS/krb5-1.4.2-1.2.20060mdk.src.rpm Mandriva Linux 2007 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/ftp-client-krb5-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/ftp-server-krb5-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/krb5-server-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/krb5-workstation-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/libkrb53-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/libkrb53-devel-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/telnet-client-krb5-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/i586/telnet-server-krb5-1.4.3-6.1mdv2007.0.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/krb5-1.4.3-6.1mdv2007.0.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/ftp-client-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/ftp-server-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/krb5-server-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/krb5-workstation-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/lib64krb53-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/lib64krb53-devel-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/telnet-client-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/x86_64/telnet-server-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/2007.0/SRPMS/krb5-1.4.3-6.1mdv2007.0.src.rpm Corporate Server 4.0 X86 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/ftp-client-krb5-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/ftp-server-krb5-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/krb5-server-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/krb5-workstation-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/libkrb53-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/libkrb53-devel-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/telnet-client-krb5-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/i586/telnet-server-krb5-1.4.3-5.1.20060mlcs4.i586.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/krb5-1.4.3-5.1.20060mlcs4.src.rpm X86_64 ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/ftp-client-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/ftp-server-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/krb5-server-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/krb5-workstation-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/lib64krb53-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/lib64krb53-devel-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/telnet-client-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/x86_64/telnet-server-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm ftp://ftp.ps.pl/mirrors/Mandrakelinux/official/updates/corporate/4.0/SRPMS/krb5-1.4.3-5.1.20060mlcs4.src.rpm Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux Sun(102772) De momento, no existe parche oficial para esta vulnerabilidad. http://sunsolve.sun.com/pub-cgi/show.pl?target=patchpage |
|
Standar resources |
|
| Property | Value |
| CVE |
CVE-2006-6143 CVE-2006-6144 |
| BID | |
Other resources |
|
|
Mandriva Security Advisory (MDKSA-2007:008) http://www.mandriva.com/security/advisories?name=MDKSA-2007:008 Kerberos http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt SUSE Security Advisory (SUSE-SA:2007:004) http://www.novell.com/linux/security/advisories/2007_04_krb5.html Sun Alert Notification (102772) http://sunsolve.sun.com/search/document.do?assetkey=1-26-102772-1 |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2007-01-11 |