Integer underflow flaws, leading to heap-based corruption, were found in the way MIT Kerberos Key Distribution Center (KDC) used to decrypt ciphertexts encrypted with Advanced Encryption Standard (AES) and ARCFOUR (RC4) encryption algorithms. A remote KDC client could provide a specially-crafted AES or RC4 encrypted ciphertext(s), which once processed by a central KDC would lead to denial of service (KDC crash or abort) or, potentially, to KDC relying authentication services compromise or arbitrary code execution with the privileges of the KDC centre.
Upstream advisory (not available yet): -------------------------------------- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-004.txt
Upstream patches (not available yet): ------------------------------------- http://web.mit.edu/kerberos/advisories/2009-004-patch1.7.txt http://web.mit.edu/kerberos/advisories/2009-004-patch1.6.3.txt
The processdbargs function in plugins/kdb/ldap/libkdbldap/ldapprincipal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5readmessage data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/useruser/server.c and lib/krb5/krb/recvauth.c.
MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to modify user-visible prompt text, modify a response to a Key Distribution Center (KDC), or forge a KRB-SAFE message via certain checksums that (1) are unkeyed or (2) use RC4 keys.