Bug 849240 (CVE-2013-1418) - VUL-0: CVE-2013-1418: krb5: multi-realm KDC null dereference leads to crash
Summary: VUL-0: CVE-2013-1418: krb5: multi-realm KDC null dereference leads to crash
Status: RESOLVED FIXED
: CVE-2013-6800 (view as bug list)
Alias: CVE-2013-1418
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Deadline: 2013-11-21
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:sle11-sp1:55037 maint...
Keywords:
Depends on:
Blocks:
 
Reported: 2013-11-06 17:17 UTC by Marcus Meissner
Modified: 2014-03-04 15:48 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-11-06 17:17:13 UTC 
via rh bugzilla

Multi-realm KDC null deref [CVE-2013-1418]

If a KDC serves multiple realms, certain requests can cause
setup_server_realm() to dereference a null pointer, crashing the KDC.

CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

A related but more minor vulnerability requires authentication to
exploit, and is only present if a third-party KDC database module can
dereference a null pointer under certain conditions.

(back ported from commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf)

http://mailman.mit.edu/pipermail/krb5-bugs/2013-November/010206.html
https://github.com/krb5/krb5/commit/5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf
https://bugzilla.redhat.com/show_bug.cgi?id=1026942
http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757
Comment 3 Swamp Workflow Management 2013-11-07 13:39:27 UTC 
The SWAMPID for this issue is 54995.
This issue was rated as moderate.
Please submit fixed packages until 2013-11-21.
When done, please reassign the bug to security-team@suse.de.
Patchinfo will be handled by security team.
Comment 6 Christian Kornacker 2013-11-08 15:24:13 UTC 
packages submitted, assigning to security team
Comment 7 Bernhard Wiedemann 2013-11-08 16:00:13 UTC 
This is an autogenerated message for OBS integration:
This bug (849240) was mentioned in
https://build.opensuse.org/request/show/206311 12.2+12.3 / krb5+krb5-mini+krb5-doc
Comment 8 Swamp Workflow Management 2013-11-08 23:00:08 UTC 
bugbot adjusting priority
Comment 9 Bernhard Wiedemann 2013-11-15 22:00:14 UTC 
This is an autogenerated message for OBS integration:
This bug (849240) was mentioned in
https://build.opensuse.org/request/show/207086 Evergreen:11.2:Test / krb5
Comment 10 Swamp Workflow Management 2013-11-21 12:04:19 UTC 
openSUSE-SU-2013:1738-1: An update that fixes one vulnerability is now available.

Category: security (low)
Bug References: 849240
CVE References: CVE-2013-1418
Sources used:
openSUSE 12.3 (src):    krb5-1.10.2-10.22.1, krb5-doc-1.10.2-10.22.2, krb5-mini-1.10.2-10.22.1
openSUSE 12.2 (src):    krb5-1.10.2-3.25.1, krb5-doc-1.10.2-3.25.2, krb5-mini-1.10.2-3.25.1
Comment 11 Bernhard Wiedemann 2013-11-21 14:00:15 UTC 
This is an autogenerated message for OBS integration:
This bug (849240) was mentioned in
https://build.opensuse.org/request/show/207858 13.1+12.2+12.3 / krb5+krb5-mini+krb5-doc
Comment 12 Bernhard Wiedemann 2013-11-21 17:00:11 UTC 
This is an autogenerated message for OBS integration:
This bug (849240) was mentioned in
https://build.opensuse.org/request/show/207880 13.1 / krb5
Comment 13 Swamp Workflow Management 2013-11-24 20:04:19 UTC 
openSUSE-SU-2013:1751-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 849240
CVE References: CVE-2013-1418
Sources used:
openSUSE 11.4 (src):    krb5-1.8.3-67.1
Comment 14 Bernhard Wiedemann 2013-11-30 22:00:26 UTC 
This is an autogenerated message for OBS integration:
This bug (849240) was mentioned in
https://build.opensuse.org/request/show/208985 Evergreen:11.2 / krb5
Comment 15 Swamp Workflow Management 2013-12-07 18:04:26 UTC 
openSUSE-SU-2013:1833-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 849240,850660
CVE References: CVE-2013-1417,CVE-2013-1418
Sources used:
openSUSE 13.1 (src):    krb5-1.11.3-3.4.1, krb5-mini-1.11.3-3.4.1
Comment 16 Swamp Workflow Management 2013-12-13 20:04:23 UTC 
Update released for: krb5, krb5-32bit, krb5-apps-clients, krb5-apps-servers, krb5-client, krb5-debuginfo, krb5-debuginfo-32bit, krb5-debugsource, krb5-devel, krb5-devel-32bit, krb5-doc, krb5-plugin-kdb-ldap, krb5-plugin-preauth-pkinit, krb5-plugins, krb5-server
Products:
SLE-SERVER 11-SP1-TERADATA (x86_64)
Comment 17 Swamp Workflow Management 2013-12-13 22:04:22 UTC 
Update released for: krb5, krb5-32bit, krb5-apps-clients, krb5-apps-servers, krb5-client, krb5-debuginfo, krb5-devel, krb5-devel-32bit, krb5-server
Products:
SLE-SERVER 10-SP3-TERADATA (x86_64)
Comment 18 Swamp Workflow Management 2013-12-13 22:54:08 UTC 
Update released for: krb5, krb5-32bit, krb5-apps-clients, krb5-apps-servers, krb5-client, krb5-debuginfo, krb5-debuginfo-32bit, krb5-debuginfo-x86, krb5-debugsource, krb5-devel, krb5-devel-32bit, krb5-doc, krb5-plugin-kdb-ldap, krb5-plugin-preauth-pkinit, krb5-plugins, krb5-server, krb5-x86
Products:
SLE-DEBUGINFO 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP3 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP3 (i386, x86_64)
Comment 19 Swamp Workflow Management 2013-12-13 23:02:44 UTC 
Update released for: krb5, krb5-32bit, krb5-apps-clients, krb5-apps-servers, krb5-client, krb5-debuginfo, krb5-debuginfo-32bit, krb5-debuginfo-x86, krb5-debugsource, krb5-devel, krb5-devel-32bit, krb5-doc, krb5-plugin-kdb-ldap, krb5-plugin-preauth-pkinit, krb5-plugins, krb5-server, krb5-x86
Products:
SLE-DEBUGINFO 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP2 (i386, x86_64)
SLE-SDK 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11-SP2 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP2 (i386, x86_64)
Comment 22 Sebastian Krahmer 2013-12-16 12:00:31 UTC 
fixed
Comment 23 Marcus Meissner 2014-03-04 15:48:16 UTC 
*** Bug 866059 has been marked as a duplicate of this bug. ***