[ASA-201806-3] krb5: insufficient validation

[Remi Gacogne]

Arch Linux Security Advisory ASA-201806-3
=========================================

Severity: Medium
Date    : 2018-06-05
CVE-ID  : CVE-2018-5729 CVE-2018-5730
Package : krb5
Type    : insufficient validation
Remote  : Yes
Link    : https://security.archlinux.org/AVG-586

Summary
=======

The package krb5 before version 1.16.1-1 is vulnerable to insufficient
validation.

Resolution
==========

Upgrade to 1.16.1-1.

# pacman -Syu "krb5>=1.16.1-1"

The problems have been fixed upstream in version 1.16.1.

Workaround
==========

None.

Description
===========

- CVE-2018-5729 (insufficient validation)

A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user
with permission to add principals to an LDAP Kerberos database can
cause a null dereference in kadmind, or circumvent a DN container
check, by supplying tagged data intended to be internal to the database
module.

- CVE-2018-5730 (insufficient validation)

A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user
with permission to add principals to an LDAP Kerberos database can
circumvent a DN containership check by supplying both a "linkdn" and
"containerdn" database argument, or by supplying a DN string which is a
left extension of a container DN string but is not hierarchically
within the container DN.

Impact
======

An authenticated kadmin user can elevate privileges or crash the
application via a crafted DN.

References
==========

https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1
https://security.archlinux.org/CVE-2018-5729
https://security.archlinux.org/CVE-2018-5730

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20180609/4a65077d/attachment.asc>