Multiple Kerberos Implementations Authentication Context Stack Overflow Vulnerability

ID ZDI-07-052
Type zdi
Reporter Tenable Network Security
Modified 2007-11-09T00:00:00


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of MIT Kerberos. Authentication is not required to exploit this vulnerability.

The specific flaw exists in the svcauth_gss_validate() function. By sending a large authentication context over RPC, a stack based buffer overflow occurs, resulting in a situation allowing for remote code execution.

The vulnerable line of the function is:

memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);

If 128 < oa->oa_length < 400, the exploitable situation occurs. Over 400 bytes is caught during a separate check for MAX_AUTH_SIZE earlier in the RPC packet decoding process.