The Java Web Server would allow remote users to obtain the source code for CGI programs.

This bug was reported to us by Stéphane BERTIN.

The pamkrb5 module does not verify that the user has permission to read from the credential cache via the existingticket option.

From the mail Stéphane sent:

I failed to open SSH session with existingticket option.

I used these options to configure pamkrb5 : auth sufficient pamkrb5.so tryfirstpass minimumuid=1 useshmem=sshd existingticket validate=sshd debug

...

Extract from manual page : "existingticket tells pamkrb5.so to accept the presence of pre-existing Kerberos credentials provided by the calling application in the default credential cache as sufficient to authenticate the user, and to skip any account management checks. DANGER! Unless validation is also in use, it is relatively easy to produce a credential cache which looks "good enough" to fool pamkrb5.so."

I use validate=sshd like it is recommended but it seems danger is around ...

I notice two things : 1) the module try twice to get credential see logs "trying existing credentials" but don't try with user password and the session failed to be opened. (that's why I have written the bug report)

2) User try to open SSH session so he doesn't already have credentials and his variable KRB5CCNAME is not defined. By default module try to get credentials on file /tmp/krb5cc0. The root credential file !!! I don't know why but root credential file doesn't have the same format krb5cc0XXXXX.

So if root ask a ticket for user TEST and get credential what happens ... If you know which credential is used by root you can open a session without to know password !!!!

Acknowledgements:

Red Hat would like to thank Stéphane Bertin for responsibly disclosing this issue.

The Sun 1.5.0 Java release includes the Sun Java 5 Runtime Environment andthe Sun Java 5 Software Development Kit.This update fixes several vulnerabilities in the Sun Java 5 RuntimeEnvironment and the Sun Java 5 Software Development Kit. Thesevulnerabilities are summarized on the "Advance notification of SecurityUpdates for Java SE" page from Sun Microsystems, listed in the Referencessection. (CVE-2009-2409, CVE-2009-3728, CVE-2009-3873, CVE-2009-3876,CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,CVE-2009-3883, CVE-2009-3884)Note: This is the final update for the java-1.5.0-sun packages, as the SunJava SE Release family 5.0 has now reached End of Service Life. The nextupdate will remove the java-1.5.0-sun packages.An alternative to Sun Java SE 5.0 is the Java 2 Technology Edition of theIBM Developer Kit for Linux, which is available from the Extras andSupplementary channels on the Red Hat Network. For users of applicationsthat are capable of using the Java 6 runtime, the OpenJDK open source JDKis included in Red Hat Enterprise Linux 5 (since 5.3) and is supported byRed Hat.Users of java-1.5.0-sun should upgrade to these updated packages, whichcorrect these issues. All running instances of Sun Java must be restartedfor the update to take effect.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment andthe Sun Java 6 Software Development Kit.This update fixes several vulnerabilities in the Sun Java 6 RuntimeEnvironment and the Sun Java 6 Software Development Kit. Thesevulnerabilities are summarized on the "Advance notification of SecurityUpdates for Java SE" page from Sun Microsystems, listed in the Referencessection. (CVE-2009-2409, CVE-2009-3728, CVE-2009-3729, CVE-2009-3865,CVE-2009-3866, CVE-2009-3867, CVE-2009-3868, CVE-2009-3869, CVE-2009-3871,CVE-2009-3872, CVE-2009-3873, CVE-2009-3874, CVE-2009-3875, CVE-2009-3876,CVE-2009-3877, CVE-2009-3879, CVE-2009-3880, CVE-2009-3881, CVE-2009-3882,CVE-2009-3883, CVE-2009-3884, CVE-2009-3886)Users of java-1.6.0-sun should upgrade to these updated packages, whichcorrect these issues. All running instances of Sun Java must be restartedfor the update to take effect.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment andthe Sun Java 6 Software Development Kit.This update fixes several vulnerabilities in the Sun Java 6 RuntimeEnvironment and the Sun Java 6 Software Development Kit. Thesevulnerabilities are summarized on the "Advance notification of SecurityUpdates for Java SE" page from Sun Microsystems, listed in the Referencessection. (CVE-2009-0217, CVE-2009-2475, CVE-2009-2476, CVE-2009-2625,CVE-2009-2670, CVE-2009-2671, CVE-2009-2672, CVE-2009-2673, CVE-2009-2674,CVE-2009-2675, CVE-2009-2676, CVE-2009-2690)Users of java-1.6.0-sun should upgrade to these updated packages, whichcorrect these issues. All running instances of Sun Java must be restartedfor the update to take effect.

The Sun 1.5.0 Java release includes the Sun Java 5 Runtime Environment andthe Sun Java 5 Software Development Kit.This update fixes several vulnerabilities in the Sun Java 5 RuntimeEnvironment and the Sun Java 5 Software Development Kit. Thesevulnerabilities are summarized on the "Advance notification of SecurityUpdates for Java SE" page from Sun Microsystems, listed in the Referencessection. (CVE-2009-2475, CVE-2009-2625, CVE-2009-2670, CVE-2009-2671,CVE-2009-2672, CVE-2009-2673, CVE-2009-2675, CVE-2009-2676, CVE-2009-2689)Users of java-1.5.0-sun should upgrade to these updated packages, whichcorrect these issues. All running instances of Sun Java must be restartedfor the update to take effect.

The Sun 1.6.0 Java release includes the Sun Java 6 Runtime Environment andthe Sun Java 6 Software Development Kit.This update fixes several vulnerabilities in the Sun Java 6 RuntimeEnvironment and the Sun Java 6 Software Development Kit. Thesevulnerabilities are summarized on the "Advance notification of SecurityUpdates for Java SE" page from Sun Microsystems, listed in the Referencessection. (CVE-2006-2426, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,CVE-2009-1096, CVE-2009-1097, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100,CVE-2009-1101, CVE-2009-1102, CVE-2009-1103, CVE-2009-1104, CVE-2009-1105,CVE-2009-1106, CVE-2009-1107)Users of java-1.6.0-sun should upgrade to these updated packages, whichcorrect these issues. All running instances of Sun Java must be restartedfor the update to take effect.

The Sun 1.5.0 Java release includes the Sun Java 5 Runtime Environment andthe Sun Java 5 Software Development Kit.This update fixes several vulnerabilities in the Sun Java 5 RuntimeEnvironment and the Sun Java 5 Software Development Kit. Thesevulnerabilities are summarized on the "Advance notification of SecurityUpdates for Java SE" page from Sun Microsystems, listed in the Referencessection. (CVE-2006-2426, CVE-2009-1093, CVE-2009-1094, CVE-2009-1095,CVE-2009-1096, CVE-2009-1098, CVE-2009-1099, CVE-2009-1100, CVE-2009-1103,CVE-2009-1104, CVE-2009-1107)Users of java-1.5.0-sun should upgrade to these updated packages, whichcorrect these issues. All running instances of Sun Java must be restartedfor the update to take effect.

The Java Runtime Environment (JRE) contains the software and tools thatusers need to run applets and applications written using the Javaprogramming language. A vulnerability was found in in Java Web Start. If a user visits amalicious website, an attacker could misuse this flaw to execute arbitrarycode. (CVE-2008-2086)Additionally, these packages fix several other critical vulnerabilities.These are summarized in the "Advance notification of Security Updates forJava SE" from Sun Microsystems.Users of java-1.6.0-sun should upgrade to these updated packages, whichcorrect these issues.

The Java Runtime Environment (JRE) contains the software and tools thatusers need to run applets and applications written using the Javaprogramming language. A vulnerability was found in in Java Web Start. If a user visits amalicious website, an attacker could misuse this flaw to execute arbitrarycode. (CVE-2008-2086)Additionally, these packages fix several other vulnerabilities. These aresummarized in the "Advance notification of Security Updates for Java SE"from Sun Microsystems. Users of java-1.5.0-sun should upgrade to these updated packages, whichcorrect these issues.