Vulnerability identifier: #VU45126

Vulnerability risk: High

CVSSv3.1: 8.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2011-0285

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Kerberos 5
Client/Desktop applications / Software for system administration

Vendor: MIT

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Kerberos 5: 1.7 - 1.9

---

External links
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=621726
http://krbdev.mit.edu/rt/Ticket/Display.html?id=6899
http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058181.html
http://osvdb.org/71789
http://secunia.com/advisories/44125
http://secunia.com/advisories/44181
http://secunia.com/advisories/44196
http://securityreason.com/securityalert/8200
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-004.txt
http://www.mandriva.com/security/advisories?name=MDVSA-2011:077
http://www.redhat.com/support/errata/RHSA-2011-0447.html
http://www.securityfocus.com/archive/1/517484/100/0/threaded
http://www.securityfocus.com/bid/47310
http://www.securitytracker.com/id?1025320
http://www.vupen.com/english/advisories/2011/0936
http://www.vupen.com/english/advisories/2011/0986
http://www.vupen.com/english/advisories/2011/0997
http://hermes.opensuse.org/messages/8086843

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.