APP: Kadmin for krb-4.1.2 Buffer Overflow

This signature detects attempts to exploit a known vulnerability against the kadmin daemon. Slackware Linux, SuSE Linux, and some BSD implementations are vulnerable. An attacker might be able to create a denial-of-service (DoS) condition or possibly execute arbitrary code in the host system.

Extended Description

A vulnerability has been discovered in the kadmind daemon. It has been reported that kadmind is vulnerable to a remotely exploitable buffer overflow. This issue is due to insufficient bounds checking. Exploiting this issue could potentially allow an attacker to execute arbitrary code with the privileges of the kadmind process. This issue is reported to exist in the Kerberos 4 administration protocol. Kerberos 5 includes support for the Kerberos 4 administration daemon. Various Kerberos implementations are reported to be affected by this vulnerability. There are reports that this vulnerability is being actively exploited in the wild.

Affected Products

Netbsd netbsd

References

BugTraq: 6024

CVE: CVE-2002-1235

URL: http://securitytracker.com/alerts/2002/Nov/1005568.html http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-002-kadm4.txt

Short Name

APP:MISC:KADMIN-4-OF

Severity

Major

Recommended

False

Recommended Action

Drop

APP: Kadmin for krb-4.1.2 Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?