Slashdot Mirror
Critical Kerberos Flaw Revealed
doi writes "ZD Net is carrying a story about '...a critical flaw that could allow hackers to circumvent the secure networking system...The problem lies with software in MIT Kerberos 5 called kadmind4 (Kerberos v4 compatibility administration daemon), which allows compatibility with older administrative clients. A buffer stack overflow allows an attacker to use a specially formed request to gain access to the KDC with the privileges of a user running kadmind4.' It affects all MIT-derived versions of Kerberos 4 and 5."
Well, how does it affect the BSD implementation? There's your answer.
And I had faith in MIT since they taught Time Cube..
As a user on a network that uses Kerberos authentication, it's good to know about these security flaws. That way, we can email the admin to find out if we should unplug our CAT5. :-)
Kerberos makes it really difficult to do any work at MIT. It's a software product designed by faculty to slow up research projects by students.
The reasons for this are twofold: ensure longer paths to tenure, and keep smart students from publishing too quickly and making their profs look bad.
-- clvrmnky
And you know, I was going to mod you up for it too...
It guards hades... oh, wait, you mean the *other* Kerberos...
Is this just a warning of a potential hole.
Or has somebody actually made an exploit.
Does anybody know of a warez site from which I can get the security patch for free.
134340: I am not a number. I am a free planet!
Breathe... breathe... it's just a buffer overflow...
Well, Microsoft is currently working on their own implementation of Kerberos, Microsoft Kerberos. I've seen about a half-dozen root exploits for MIT kerberos, but none yet for MS kerb. I guess this is really a first for the boys in blue. ;]
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
Kerberos is a three-headed dog that guards the gates of hell. A flaw in Kerberos is a serious situation because if it fails, all hell could break loose.
I completely agree. I say that people wait until the respective worm comes out for the said vulnerability, then post an article about that, where hundreds of /. comments will mock stupid people for not patching their systems. =)
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
Stack overflow, stack overflow... Better create an architecture and/or compiler where is NO stack at all! Be much more secure then.
---
How is everybody spent todays' slashdot meetup?
If only we were all using Windows this could have been avoided. :(
NO CARRIER
If you did your thesis on buffer overflows, you'd be halfway done already.
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
It doesn't matter what you do...some part of your security solution is going be broken by some hackers at some point. Get used to it, deal with it.
Me, I spend the money my boss gives me for security on beer and better video cards for my office mates that like unreal tournament.
Oh, I should also mention that in addition to not providing any type of network secuity you must also not supply any type of network monitoring. Can you imagine...you're two frags from godlike and some system monitor (that you don't understand anyway) starts paging your beeper like a crazy x-girlfriend.
You might just lose concentration.
Here before all but 8486 of you.
Hey, it worked - at least, it sure got me to read the blurb in a hurry. (While hyperventilating, but whatever.) Maybe they did it on purpose. At least the panic attack only lasted a couple sentences. If they'd made me actually read the article to find this out....
"How can you claim that you are anti-crack, while still writing a window manager?" — Metacity README