MGASA-2017-0420

Dashboard / Vulnerabilities / MGASA-2017-0420

MGASA-2017-0420

Summary: Updated krb5 packages fix security vulnerabilities

Details: An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances (CVE-2017-7562). Note that this issue only affects Mageia 6. RFC 2744 permits a GSS-API implementation to delete an existing security context on a second or subsequent call to gss_init_sec_context() or gss_accept_sec_context() if the call results in an error. This API behavior has been found to be dangerous, leading to the possibility of memory errors in some callers. For safety, GSS-API implementations should instead preserve existing security contexts on error until the caller deletes them (CVE-2017-11462). A buffer overflow vulnerability was found in get_matching_data() function when both the CA cert and the user cert have a long subject affecting krb5 that includes certauth plugin. Attack requires a validated certificate with a long subject and issuer, and a "pkinit_cert_match" string attribute on some principal in the database. A remote code execution exploit might also require that the attacker gets to choose the contents of the issuer in the validated cert (CVE-2017-15088).

References: https://advisories.mageia.org/MGASA-2017-0420.html, https://bugs.mageia.org/show_bug.cgi?id=21628, https://lists.fedoraproject.org/archives/list/[email protected]/thread/2XIPFDWKYB3HQKSWLVJ6AAPFEG6BEPE3/, https://lists.fedoraproject.org/archives/list/[email protected]/thread/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/, https://lists.opensuse.org/opensuse-updates/2017-11/msg00039.html