Title: MIT Kerberos 'asn1_decode_generaltime()' Uninitialized Pointer Memory Corruption Vulnerability
Severity: HIGH
Description:
MIT Kerberos is a suite of applications and libraries designed to implement the Kerberos network-authentication protocol. It is freely available and operates on numerous platforms.
MIT Kerberos is prone to a memory-corruption vulnerability because it fails to properly initialize data structures. Specifically, the 'asn1_decode_generaltime()' function can free an uninitialized pointer when decoding an invalid DER encoding of ASN.1 type 'GeneralizedTime'.
Successful exploits may allow remote attackers to crash Kerberos servers, including the 'kadmind' administration daemon. Given the nature of this issue, attackers may also be able to execute arbitrary code with SYSTEM-level or superuser privileges, but this has not been confirmed.
Versions prior to Kerberos 5.17 and 5.1.6.4 are vulnerable.
Affected Products:
- Avaya AES 4.0
- Avaya AES 4.0.1
- Avaya AES 4.1
- Avaya AES 4.2
- Avaya AES 4.2.1
- Avaya AES 4.2.2
- Avaya CMS Server 13.0.0
- Avaya CMS Server 13.1
- Avaya CMS Server 14.0
- Avaya CMS Server 14.1
- Avaya CMS Server 15.0
- Avaya Communication Manager 3.0
- Avaya Communication Manager 3.1
- Avaya Communication Manager 3.1.4 SP2
- Avaya Communication Manager 4.0
- Avaya Communication Manager 4.0.3 SP1
- Avaya Communication Manager 5.0
- Avaya Communication Manager 5.0 SP3
- Avaya Communication Manager 5.1
- Avaya Communication Manager Server DEFINITY Server SI/CS
- Avaya Communication Manager Server S8100
- Avaya Communication Manager Server S8300
- Avaya Communication Manager Server S8500
- Avaya Communication Manager Server S8700
- Avaya Intuity AUDIX LX 2.0
- Avaya Intuity AUDIX LX 2.0 SP1
- Avaya Intuity AUDIX LX 2.0 SP2
- Avaya Meeting Exchange 5.0
- Avaya Meeting Exchange 5.0 SP1
- Avaya Meeting Exchange 5.0 SP2
- Avaya Meeting Exchange 5.1
- Avaya Meeting Exchange 5.1 SP1
- Avaya Message Networking 3.1
- Avaya Message Networking MN 3.1
- Avaya Messaging Storage Server 3.1
- Avaya Messaging Storage Server 4.0
- Avaya Messaging Storage Server 5.0
- Avaya Proactive Contact 4.0
- Avaya Proactive Contact 4.1
- Avaya Voice Portal 4.0
- Avaya Voice Portal 4.1
- Conectiva Linux 8.0.0
- Debian Linux 3.0.0
- Debian Linux 3.0.0 alpha
- Debian Linux 3.0.0 arm
- Debian Linux 3.0.0 hppa
- Debian Linux 3.0.0 ia-32
- Debian Linux 3.0.0 ia-64
- Debian Linux 3.0.0 m68k
- Debian Linux 3.0.0 mips
- Debian Linux 3.0.0 mipsel
- Debian Linux 3.0.0 ppc
- Debian Linux 3.0.0 s/390
- Debian Linux 3.0.0 sparc
- Debian Linux 4.0
- Debian Linux 4.0 alpha
- Debian Linux 4.0 amd64
- Debian Linux 4.0 arm
- Debian Linux 4.0 armel
- Debian Linux 4.0 hppa
- Debian Linux 4.0 ia-32
- Debian Linux 4.0 ia-64
- Debian Linux 4.0 m68k
- Debian Linux 4.0 mips
- Debian Linux 4.0 mipsel
- Debian Linux 4.0 powerpc
- Debian Linux 4.0 s/390
- Debian Linux 4.0 sparc
- Debian Linux 5.0
- Debian Linux 5.0 alpha
- Debian Linux 5.0 amd64
- Debian Linux 5.0 arm
- Debian Linux 5.0 armel
- Debian Linux 5.0 hppa
- Debian Linux 5.0 ia-32
- Debian Linux 5.0 ia-64
- Debian Linux 5.0 m68k
- Debian Linux 5.0 mips
- Debian Linux 5.0 mipsel
- Debian Linux 5.0 powerpc
- Debian Linux 5.0 s/390
- Debian Linux 5.0 sparc
- Gentoo Linux
- MIT Kerberos 5 1.0.0
- MIT Kerberos 5 1.0.6
- MIT Kerberos 5 1.0.8
- MIT Kerberos 5 1.1.0
- MIT Kerberos 5 1.1.1
- MIT Kerberos 5 1.2.0
- MIT Kerberos 5 1.2.1
- MIT Kerberos 5 1.2.2
- MIT Kerberos 5 1.2.2 -beta1
- MIT Kerberos 5 1.2.3
- MIT Kerberos 5 1.2.4
- MIT Kerberos 5 1.2.5
- MIT Kerberos 5 1.2.6
- MIT Kerberos 5 1.2.7
- MIT Kerberos 5 1.2.8
- MIT Kerberos 5 1.3.0
- MIT Kerberos 5 1.3.0 -alpha1
- MIT Kerberos 5 1.3.1
- MIT Kerberos 5 1.3.2
- MIT Kerberos 5 1.3.3
- MIT Kerberos 5 1.3.4
- MIT Kerberos 5 1.3.5
- MIT Kerberos 5 1.3.6
- MIT Kerberos 5 1.4.0
- MIT Kerberos 5 1.4.1
- MIT Kerberos 5 1.4.2
- MIT Kerberos 5 1.4.3
- MIT Kerberos 5 1.5.0
- MIT Kerberos 5 1.5.1
- MIT Kerberos 5 1.5.2
- MIT Kerberos 5 1.5.3
- MIT Kerberos 5 1.5.4
- MIT Kerberos 5 1.5.5
- MIT Kerberos 5 1.6.0
- MIT Kerberos 5 1.6.1
- MIT Kerberos 5 1.6.2
- MIT Kerberos 5 1.6.3
- MIT Kerberos 5 5.0.0 -1.0.x
- MIT Kerberos 5 5.0.0 -1.1
- MIT Kerberos 5 5.0.0 -1.1.1
- MIT Kerberos 5 5.0.0 -1.2beta1
- MIT Kerberos 5 5.0.0 -1.2beta2
- MIT Kerberos 5 5.0.0 -1.3.3
- MIT Kerberos 5 5.0.0 -1.3.4
- MIT Kerberos 5 5.0.0 -1.3.5
- MIT Kerberos 5 5.0.0 -1.3.6
- MIT Kerberos 5 5.0.0 -1.4
- MIT Kerberos 5 5.0.0 -1.4.1
- MandrakeSoft Corporate Server 2.1.0
- MandrakeSoft Corporate Server 2.1.0 x86_64
- MandrakeSoft Corporate Server 3.0.0
- MandrakeSoft Corporate Server 3.0.0 x86_64
- MandrakeSoft Corporate Server 4.0
- MandrakeSoft Corporate Server 4.0.0 x86_64
- MandrakeSoft Linux Mandrake 10.0.0
- MandrakeSoft Linux Mandrake 10.0.0 amd64
- MandrakeSoft Linux Mandrake 10.1.0
- MandrakeSoft Linux Mandrake 10.1.0 x86_64
- MandrakeSoft Linux Mandrake 2008.1
- MandrakeSoft Linux Mandrake 2008.1 x86_64
- MandrakeSoft Linux Mandrake 2009.0
- MandrakeSoft Linux Mandrake 2009.0 x86_64
- MandrakeSoft Linux Mandrake 8.1.0
- MandrakeSoft Linux Mandrake 8.1.0 ia64
- MandrakeSoft Linux Mandrake 8.2.0
- MandrakeSoft Linux Mandrake 8.2.0 ppc
- MandrakeSoft Linux Mandrake 9.0.0
- MandrakeSoft Linux Mandrake 9.1.0
- MandrakeSoft Linux Mandrake 9.1.0 ppc
- MandrakeSoft Linux Mandrake 9.2.0
- MandrakeSoft Linux Mandrake 9.2.0 amd64
- MandrakeSoft Multi Network Firewall 2.0.0
- Novell Open Enterprise Server 2
- OpenBSD OpenBSD 3.1
- OpenBSD OpenBSD 3.2
- Pardus Linux 2008
- RedHat Advanced Workstation for the Itanium Processor 2.1.0
- RedHat Desktop 3.0.0
- RedHat Desktop 4.0.0
- RedHat Enterprise Linux 5 server
- RedHat Enterprise Linux AS 2.1
- RedHat Enterprise Linux AS 2.1 IA64
- RedHat Enterprise Linux AS 3
- RedHat Enterprise Linux AS 4
- RedHat Enterprise Linux Desktop 5 client
- RedHat Enterprise Linux Desktop Workstation 5 client
- RedHat Enterprise Linux Desktop version 4
- RedHat Enterprise Linux ES 2.1
- RedHat Enterprise Linux ES 2.1 IA64
- RedHat Enterprise Linux ES 3
- RedHat Enterprise Linux ES 4
- RedHat Enterprise Linux WS 2.1
- RedHat Enterprise Linux WS 2.1 IA64
- RedHat Enterprise Linux WS 3
- RedHat Enterprise Linux WS 4
- RedHat Fedora 10
- RedHat Fedora 9
- RedHat Fedora Core1
- RedHat Fedora Core2
- RedHat Fedora Core3
- RedHat Linux 6.2.0
- RedHat Linux 6.2.0 alpha
- RedHat Linux 6.2.0 i386
- RedHat Linux 6.2.0 sparc
- RedHat Linux 7.0.0
- RedHat Linux 7.0.0 alpha
- RedHat Linux 7.0.0 i386
- RedHat Linux 7.1.0
- RedHat Linux 7.1.0 alpha
- RedHat Linux 7.1.0 i386
- RedHat Linux 7.1.0 ia64
- RedHat Linux 7.2.0
- RedHat Linux 7.2.0 i386
- RedHat Linux 7.2.0 ia64
- RedHat Linux 7.3.0
- RedHat Linux 7.3.0 i386
- RedHat Linux 8.0.0
- RedHat Linux 8.0.0 i386
- RedHat Linux 9.0.0 i386
- S.u.S.E. SLE 11
- S.u.S.E. SLE SDK 10 SP2
- S.u.S.E. SLED 11
- S.u.S.E. SLES 11
- S.u.S.E. SLES 11 DEBUGINFO
- S.u.S.E. SUSE Linux Enterprise 10 SP2 DEBUGINFO
- S.u.S.E. SUSE Linux Enterprise Desktop 10 SP2
- S.u.S.E. SUSE Linux Enterprise Server 10 SP2
- S.u.S.E. openSUSE 10.3
- S.u.S.E. openSUSE 11.0
- S.u.S.E. openSUSE 11.1
- Sun OpenSolaris build snv_01
- Sun OpenSolaris build snv_02
- Sun OpenSolaris build snv_100
- Sun OpenSolaris build snv_101
- Sun OpenSolaris build snv_101a
- Sun OpenSolaris build snv_102
- Sun OpenSolaris build snv_103
- Sun OpenSolaris build snv_104
- Sun OpenSolaris build snv_104
- Sun OpenSolaris build snv_105
- Sun OpenSolaris build snv_106
- Sun OpenSolaris build snv_107
- Sun OpenSolaris build snv_108
- Sun OpenSolaris build snv_109
- Sun OpenSolaris build snv_110
- Sun OpenSolaris build snv_111
- Sun OpenSolaris build snv_112
- Sun OpenSolaris build snv_13
- Sun OpenSolaris build snv_19
- Sun OpenSolaris build snv_22
- Sun OpenSolaris build snv_29
- Sun OpenSolaris build snv_36
- Sun OpenSolaris build snv_39
- Sun OpenSolaris build snv_45
- Sun OpenSolaris build snv_47
- Sun OpenSolaris build snv_50
- Sun OpenSolaris build snv_57
- Sun OpenSolaris build snv_59
- Sun OpenSolaris build snv_61
- Sun OpenSolaris build snv_64
- Sun OpenSolaris build snv_67
- Sun OpenSolaris build snv_68
- Sun OpenSolaris build snv_76
- Sun OpenSolaris build snv_77
- Sun OpenSolaris build snv_78
- Sun OpenSolaris build snv_80
- Sun OpenSolaris build snv_81
- Sun OpenSolaris build snv_82
- Sun OpenSolaris build snv_83
- Sun OpenSolaris build snv_84
- Sun OpenSolaris build snv_85
- Sun OpenSolaris build snv_86
- Sun OpenSolaris build snv_87
- Sun OpenSolaris build snv_88
- Sun OpenSolaris build snv_89
- Sun OpenSolaris build snv_90
- Sun OpenSolaris build snv_91
- Sun OpenSolaris build snv_92
- Sun OpenSolaris build snv_93
- Sun OpenSolaris build snv_94
- Sun OpenSolaris build snv_95
- Sun OpenSolaris build snv_96
- Sun OpenSolaris build snv_99
- Sun SEAM 1.0.1
- Sun Solaris 10.0
- Sun Solaris 10.0_x86
- Sun Solaris 8
- Sun Solaris 8_x86
- Sun Solaris 9
- Sun Solaris 9_x86
- Trustix Secure Enterprise Linux 2.0.0
- Trustix Secure Linux 2.1.0
- Trustix Secure Linux 2.2.0
- Turbolinux Home
- Turbolinux Turbolinux 10 F...
- Turbolinux Turbolinux Desktop 10.0.0
- Turbolinux Turbolinux Server 10.0.0
- Turbolinux Turbolinux Server 8.0.0
- Ubuntu Ubuntu Linux 6.06 LTS amd64
- Ubuntu Ubuntu Linux 6.06 LTS i386
- Ubuntu Ubuntu Linux 6.06 LTS powerpc
- Ubuntu Ubuntu Linux 6.06 LTS sparc
- Ubuntu Ubuntu Linux 7.10 amd64
- Ubuntu Ubuntu Linux 7.10 i386
- Ubuntu Ubuntu Linux 7.10 lpia
- Ubuntu Ubuntu Linux 7.10 powerpc
- Ubuntu Ubuntu Linux 7.10 sparc
- Ubuntu Ubuntu Linux 8.04 LTS amd64
- Ubuntu Ubuntu Linux 8.04 LTS i386
- Ubuntu Ubuntu Linux 8.04 LTS lpia
- Ubuntu Ubuntu Linux 8.04 LTS powerpc
- Ubuntu Ubuntu Linux 8.04 LTS sparc
- Ubuntu Ubuntu Linux 8.10 amd64
- Ubuntu Ubuntu Linux 8.10 i386
- Ubuntu Ubuntu Linux 8.10 lpia
- Ubuntu Ubuntu Linux 8.10 powerpc
- Ubuntu Ubuntu Linux 8.10 sparc
- WireX Immunix OS 7+
- rPath Appliance Platform Linux Service 1
- rPath Appliance Platform Linux Service 2
- rPath rPath Linux 1
- rPath rPath Linux 2
References:
- Avaya: ASA-2009-142 Multiple Security Vulnerabilities in the Solaris Kerberos 'Mech' Li
- Avaya: ASA-2009-162 krb5 security update (RHSA-2009-0409)
- CERT: VU#662091
- MIT: Kerberos Homepage
- MIT: MITKRB5-SA-2009-002
- Novell: NKDC 20090409
- Novell: NKDC 20090409
- Sun: Solution 256728: Multiple Security Vulnerabilities in the Solaris Kerberos 'Mech
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
