Kerberos 5 KAdminD服务程序远程栈溢出漏洞

受影响系统： 
MIT Kerberos 5 <= 1.6
不受影响系统： 
MIT Kerberos 5 1.6.1
描述： 

BUGTRAQ  ID: 23285
CVE(CAN) ID: CVE-2007-0957

Kerberos是一款广泛使用的使用强壮的加密来验证客户端和服务器端的网络协议。MIT Kerberos 5是一种常用的开源Kerberos实现。

Kerberos 5 KAdminD服务程序在处理畸形格式的日志串时存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞控制服务器。

Kerberos 5的krb5_klog_syslog()使用vsprintf()将文本格式化到固定长度的栈缓冲区。在该函数调用中所使用的“%s”之类的格式标识符可能导致格式化过多的字符串，以至于覆盖到栈缓冲区末尾之后的内存。

KDC在记录日志之前会截短大多数发送给客户端的字符串，但没有截短transited-realms字符串。与目标域共享密钥的恶意KDC可以发布有特制transited-realms字符串的凭据来触发栈溢出，导致拒绝服务或执行任意指令。其他调用krb5_klog_syslog()的服务器应用也可能受影响。

<*来源：iDEFENSE
  
  链接：http://www.kb.cert.org/vuls/id/704024
        http://marc.info/?l=bugtraq&m=117562613804863&w=2
        http://lwn.net/Alerts/229046
        http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=500
        http://www.us-cert.gov/cas/techalerts/TA07-093B.html
        http://www.debian.org/security/2007/dsa-1276
        http://security.gentoo.org/glsa/glsa-200704-02.xml
*>

建议： 

厂商补丁：

Debian
------
Debian已经为此发布了一个安全公告（DSA-1276-1）以及相应补丁:
DSA-1276-1：New krb5 packages fix several vulnerabilities
链接：http://www.debian.org/security/2007/dsa-1276

补丁下载：

Source archives:

http://security.debian.org/pool/updates/main/k/krb5/krb5_1.3.6-2sarge4.dsc
Size/MD5 checksum:      782 a4a9a2cff9292af1de210f83edcee281
http://security.debian.org/pool/updates/main/k/krb5/krb5_1.3.6-2sarge4.diff.gz
Size/MD5 checksum:   666048 006edbace85ee6fab561c8f5ba59914d
http://security.debian.org/pool/updates/main/k/krb5/krb5_1.3.6.orig.tar.gz
Size/MD5 checksum:  6526510 7974d0fc413802712998d5fc5eec2919

Architecture independent components:

http://security.debian.org/pool/updates/main/k/krb5/krb5-doc_1.3.6-2sarge4_all.deb
Size/MD5 checksum:   718724 9bd56e8f5a673661416a042cc315509b

Alpha architecture:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:   114882 0b1d6a3f226b48f3065f8e065049a02a
http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:   247602 b36d6e32ae319ed6953327d0de0e091c
http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:    62892 a96ce75c69cc4423f0922a49ce97b7ef
http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:   137006 6285c054dbb18b511153aeab6d5bb399
http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:    89654 491c88a0bea723021f0f1eda84450208
http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:    72142 3cad8d2db4270a422c0ba0ccfd6a9151
http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:   144782 dea1c0c916c80b59174b4cfd18f1eb5e
http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:   201754 42d6fcb995989672cfde30a467f9486e
http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:   860980 3dabb660978f0d3cfc2c121acf8a48de
http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.3.6-2sarge4_alpha.deb
Size/MD5 checksum:   422446 d1a9263aa8929f74016c05d576aee119

AMD64 architecture:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:   104412 e8745bef65a969fc66e85f2e05fc460c
http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:   216804 6cac5d3359fd89e684da8020737d3bf5
http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:    56842 48564b65fede1322e806761578284afe
http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:   124622 63fdfbb8262a301fea57201abe745ccf
http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:    82604 9aa00994ff6db71ceea74e40774ec004
http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:    63404 9374de7ff3893edf7d15d59afe69014d
http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:   137616 a3299d431fdeefc0a97cdf0dda8f0c32
http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:   177494 3343049ddfd8a6c6f92f72bb6d01236d
http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:   652190 4c662956e4fd6048718aafb636e86eb9
http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.3.6-2sarge4_amd64.deb
Size/MD5 checksum:   369222 2d5d91d193a1b9a974e94c7a6a285fa3

ARM architecture:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:    93246 da4123366ef29bedeb4c311b0a1a2126
http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:   192714 3f6ff7ed3a85692a519d42abd81eac0b
http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:    53524 c3da0283dddf25e3b0c56ff8a96f4915
http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:   115350 cacaf8656e56b5d6b48cbebdb82e0867
http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:    74736 272dc94b86b09c30713f992eca1fe821
http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:    57966 ed7fb406f72392755271a6566c26f4a3
http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:   127322 c7e623470e20fe820f542f39f4153a92
http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:   158514 54ea5f70bf9670248228abac564f3789
http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:   633650 746035ffc674dda29c2d210cec2b1fb2
http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.3.6-2sarge4_arm.deb
Size/MD5 checksum:   329018 361b300241f40c9ca6b19699e9a21808

HP Precision architecture:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:   104264 d76de2355f7087f0fb714f74df37ce8f
http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:   223960 87e7ec87182ecdbfdf78cb8b671b4938
http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:    59164 e402fcaf185e9b71a8c22ed66360cc5c
http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:   124948 17782c833aa2b3a5913e43486babdd75
http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:    81792 8abee5e8628ca43b28a9817b525e51e7
http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:    64084 833c24350b1da5c5ee344091b7326162
http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:   138992 1de0af508b0209ed74c55cf2360600d1
http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:   187080 a8e725187772da6af103407ddc837805
http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:   669466 df7019788a52698f5fca94b5a6b636d1
http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.3.6-2sarge4_hppa.deb
Size/MD5 checksum:   383676 3b3d54cdeff6e16d5999a77b05bdef56

Intel IA-32 architecture:

http://security.debian.

[1] [2] [3] [4] [5] [6] 下一页