#VU45126 Input validation error in Kerberos 5 - CVE-2011-0285

Vulnerability identifier: #VU45126

Vulnerability risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2011-0285

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Kerberos 5
Client/Desktop applications / Software for system administration

Vendor: MIT

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Kerberos 5: 1.7 - 1.9

---

External links
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621726
https://krbdev.mit.edu/rt/Ticket/Display.html?id=6899
https://lists.fedoraproject.org/pipermail/package-announce/2011-April/058181.html
https://osvdb.org/71789
https://secunia.com/advisories/44125
https://secunia.com/advisories/44181
https://secunia.com/advisories/44196
https://securityreason.com/securityalert/8200
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt
https://www.mandriva.com/security/advisories?name=MDVSA-2011:077
https://www.redhat.com/support/errata/RHSA-2011-0447.html
https://www.securityfocus.com/archive/1/517484/100/0/threaded
https://www.securityfocus.com/bid/47310
https://www.securitytracker.com/id?1025320
https://www.vupen.com/english/advisories/2011/0936
https://www.vupen.com/english/advisories/2011/0986
https://www.vupen.com/english/advisories/2011/0997
https://hermes.opensuse.org/messages/8086843

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.