{"vuid":"VU#885830","idnumber":"885830","name":"MIT Kerberos 5 allows unauthenticated attacker to cause MIT krb5 Key Distribution Center to overflow a heap buffer by one byte","keywords":["MIT Kerberos 5","heap buffer overflow","krb5","KDC"],"overview":"An unauthenticated attacker can cause MIT krb5 Key Distribution Center (KDC) to overflow a heap buffer by one byte, possibly leading to arbitrary code execution.","clean_desc":"Kerberos is a network authentication system which uses a trusted third party (a KDC) to authenticate clients and servers to each other. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. MIT Kerberos code is used in network applications from a variety of different vendors and is included in many UNIX and Linux distributions. The MIT krb5 Security Advisory 2005-002 issued 2005 July 12, available from \n<http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-002-kdc.txt> indicates: When an MIT krb5 Key Distribution Center (KDC) implementation receives a certain unlikely (but valid) request via a TCP or UDP connection it can trigger a bug in the krb5 library which results in a single-byte overflow of a heap buffer. Application servers are vulnerable to a highly improbable attack, provided that the attacker controls a realm sharing a cross-realm key with the target realm.","impact":"An unauthenticated attacker may be able to use this vulnerability to execute arbitrary code on the KDC host, potentially compromising an entire Kerberos realm. According to the MIT krb5 Security Advisory 2005-002 this vulnerability affects KDC implementations and application servers in all MIT krb5 releases, up to and including krb5-1.4.1. Third-party application servers that use MIT krb5 are also affected.","resolution":"Apply patches available from your vendor. Details of the patch are also available from http://web.mit.edu/kerberos/advisories/2005-002-patch_1.4.1.txt.","workarounds":"","sysaffected":"","thanks":"This vulnerability was reported by the MIT Kerberos Development Team. The MIT Kerberos Development Team thank Daniel Wachdorf for reporting this vulnerability.","author":"This document was written by Robert Mead based on information in the MIT krb5 Security Advisory 2005-002.","public":["http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-002-kdc.txt","http://web.mit.edu/kerberos/advisories/2005-002-patch_1.4.1.txt"],"cveids":["CVE-2005-1175"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2005-05-09T16:09:47Z","publicdate":"2005-07-12T00:00:00Z","datefirstpublished":"2005-07-13T15:15:13Z","dateupdated":"2005-07-13T15:15:32Z","revision":26,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"5","cam_exploitation":"0","cam_internetinfrastructure":"17","cam_population":"17","cam_impact":"11","cam_easeofexploitation":"4","cam_attackeraccessrequired":"15","cam_scorecurrent":"4.62825","cam_scorecurrentwidelyknown":"7.783875","cam_scorecurrentwidelyknownexploited":"11.991375","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":4.62825,"vulnote":null}