REDHAT-BUG-2438715: Buffer Overflow
MUNGE is an authentication service for creating and validating user credentials. From 0.5 to 0.5.17, local attacker can exploit a buffer overflow vulnerability in munged (the MUNGE authentication daemon) to leak cryptographic key material from process memory. With the leaked key material, the attacker could forge arbitrary MUNGE credentials to impersonate any user (including root) to services that rely on MUNGE for authentication. The vulnerability allows a buffer overflow by sending a crafted message with an oversized address length field, corrupting munged's internal state and enabling extraction of the MAC subkey used for credential verification. This vulnerability is fixed in 0.5.18.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
munged (MUNGE authentication daemon)to a version that resolves this vulnerability.Fixed in 0.5.18 - Compensating control
Restrict network access to the munged service to reduce exposure to attackers sending crafted oversized address-length fields.
- Operational
After upgrading to 0.5.18, invalidate/recreate MUNGE credential key material (e.g., regenerate the MUNGE cryptographic keys) because leaked MAC subkey material could be used to forge credentials until keys are rotated.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2438715?
The severity of REDHAT-BUG-2438715 is high due to the potential for local attackers to exploit a buffer overflow vulnerability.
How do I fix REDHAT-BUG-2438715?
To fix REDHAT-BUG-2438715, upgrade MUNGE to version 0.5.18 or later.
What systems are affected by REDHAT-BUG-2438715?
REDHAT-BUG-2438715 affects MUNGE versions from 0.5 to 0.5.17.
What type of vulnerability is REDHAT-BUG-2438715?
REDHAT-BUG-2438715 is a buffer overflow vulnerability that allows for the leakage of cryptographic key material.
Can a remote attacker exploit REDHAT-BUG-2438715?
No, REDHAT-BUG-2438715 can only be exploited by a local attacker.