CVE-2011-0284 - Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Ce

CVE-2011-0284

Summary

Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT feature is enabled, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an e_data field containing typed data.

References

Vulnerable Configurations

cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.7:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8.1:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8.2:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8.2:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8.3:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.8.3:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.9:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.9:*:*:*:*:*:*:*

CVSS

Base:	7.6 (as of 21-01-2020 - 15:46)
Impact:
Exploitability:

CWE

CWE-399

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:H/Au:N/C:C/I:C/A:C

redhat via4

advisories

bugzilla

id	674325
title	CVE-2011-0284 krb5 (krb5kdc): Double-free flaw by handling error messages upon receiving certain AS_REQ's (MITKRB5-SA-2011-003)

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 6 is installed
oval oval:com.redhat.rhba:tst:20111656003

AND
comment krb5-devel is earlier than 0:1.8.2-3.el6_0.6
oval oval:com.redhat.rhsa:tst:20110356001
comment krb5-devel is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20192599002
AND
comment krb5-libs is earlier than 0:1.8.2-3.el6_0.6
oval oval:com.redhat.rhsa:tst:20110356003
comment krb5-libs is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20192599004

AND

comment krb5-pkinit-openssl is earlier than 0:1.8.2-3.el6_0.6
oval oval:com.redhat.rhsa:tst:20110356005
comment krb5-pkinit-openssl is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20100863006

AND
comment krb5-server is earlier than 0:1.8.2-3.el6_0.6
oval oval:com.redhat.rhsa:tst:20110356007
comment krb5-server is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20192599008

AND

comment krb5-server-ldap is earlier than 0:1.8.2-3.el6_0.6
oval oval:com.redhat.rhsa:tst:20110356009
comment krb5-server-ldap is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20192599010

AND

comment krb5-workstation is earlier than 0:1.8.2-3.el6_0.6
oval oval:com.redhat.rhsa:tst:20110356011
comment krb5-workstation is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhba:tst:20192599012

rhsa

id	RHSA-2011:0356
released	2011-03-16
severity	Important
title	RHSA-2011:0356: krb5 security update (Important)

rpms

krb5-debuginfo-0:1.8.2-3.el6_0.6
krb5-devel-0:1.8.2-3.el6_0.6
krb5-libs-0:1.8.2-3.el6_0.6
krb5-pkinit-openssl-0:1.8.2-3.el6_0.6
krb5-server-0:1.8.2-3.el6_0.6
krb5-server-ldap-0:1.8.2-3.el6_0.6
krb5-workstation-0:1.8.2-3.el6_0.6

refmap via4

bid	46881
bugtraq	20110315 MITKRB5-SA-2011-003 [CVE-2011-0284] KDC double-free when PKINIT enabled
cert-vn	VU#943220
confirm	http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-003.txt
fedora	FEDORA-2011-3462 FEDORA-2011-3464 FEDORA-2011-3547
mandriva	MDVSA-2011:048
osvdb	71183
sectrack	1025216
secunia	43700 43760 43783 43881
suse	SUSE-SR:2011:005
ubuntu	USN-1088-1
vupen	ADV-2011-0672 ADV-2011-0673 ADV-2011-0680 ADV-2011-0722 ADV-2011-0763
xf	kerberos-perpareerroras-code-execution(66101)

Last major update

21-01-2020 - 15:46

Published

20-03-2011 - 02:00

Last modified

21-01-2020 - 15:46