Slashdot Mirror
Critical Kerberos Flaw Revealed
doi writes "ZD Net is carrying a story about '...a critical flaw that could allow hackers to circumvent the secure networking system...The problem lies with software in MIT Kerberos 5 called kadmind4 (Kerberos v4 compatibility administration daemon), which allows compatibility with older administrative clients. A buffer stack overflow allows an attacker to use a specially formed request to gain access to the KDC with the privileges of a user running kadmind4.' It affects all MIT-derived versions of Kerberos 4 and 5."
Good thing I use a secure protocol like telnet. When was the last telnet remote r00t exploit?
Only the State obtains its revenue by coercion. - Murray Rothbard
How does this affect M$FT's implementation of K5?
For a minute, I almost wondered if the actual cryptosystem had been broken, but then I realized that this is only the implementation of it. There's a *big* difference...
:]
Fortunately, all we have to do is download a patch, which is much better than having to find something other than Diffie-Hellman key exchange...
Chicks love Slashdot.org!
That means it does not hurt the opensource version of Kerberos V, heimdal because it does not support Kerberos IV which is supported by KTH.
My, time does fly!
I used teh intarnate!@@!@!@ FOR HACKIGN!@# !@!@
LOLOLOLOL!!!
-Zero Cool, alias Dade Murphy
Microsoft has had a patch out for days now. How long before Linux and OpenBSD catch up?
Little, whiny, open-source-loving bitches who will never ever get the pussy. Hah, eat this boys!
Will nefarious hackers now be able track them throughout the world?
What the flaming fuck does kerberos do anyway?
I hate sigs.
Here
This has been known for awhile. The OpenBSD errata contained a patch fixing the flaw in the 3.0 and 3.1 releases three days ago.
Keep up the good work with the funny and original text substitution. My colleagues and I had quite a chuckle at Micro$oft's (heh heh) expense.
I don't give a RED FUCK about any of that.
Though this seems to be an increasing trend, do we really need to see bug reports like this on Slashdot, even if they are security related? I can understand if the actual protocol was flawed, but this is just a bug in the admin daemon. If I wanted bug and patch information, I would go to bugtraq, or the OpenBSD security list, both of which covered this days ago.
Why worry about it? They already have a patch so I don't think it's a big deal. If your a administrator who doesn't keep up with bugtraq or other mailing lists then your just asking for trouble. Just hope no one already exploited this hole on your system :)
"I believe in everything in moderation. Including moderation." -Dean DeLeo, Stone Temple Pilots
And I had faith in MIT since they taught Time Cube..
As a user on a network that uses Kerberos authentication, it's good to know about these security flaws. That way, we can email the admin to find out if we should unplug our CAT5. :-)
..on stories like this is if you'd just put some short thing telling how to determine if you are affected by the security hole.
/sbin/sshd --version and it says your version is 2.23 or lower, you're affected".
:)
like, just say "if you type
A lot of the time it's kind of hard to remember which version exactly you have, and much UNIX software offers no quick, clear way to tell what version you have installed. Hell, i don't even know if i have kerberos. I know i've never consiously used kerberos. But for all i know my linux distribution installed kerberos as part of another package. Now i, and a bunch of other people, are going to be poking around manpages and wierd directories for awhile trying to figure out, uhh, do we have kerberos, what version/brand, do we need to disable or patch anything.. this is not the hardest thing in the world, but it isn't exactly easy when you consider it's 11:12 PM and at my college, we start drinking on thursday night. I'm not exactly in the mood to think logically at this exact moment.
So, a quick 'heads up, here's the quick way to tell if you're affected' on the part of the slashdotty people at the end of these story blurbs would be much appreciated
(I'm not posting this in an attempt to prove I know anything, I just think a clearly worded reply might benefit a few folks, e.g. me)
sig-free as of 28 July 02!
Whoa, reading this title I thought maybe it was an actual flaw in the protocol! But it's just a buffer overflow. At least ZDNet put "critical" in quotes.
So all I have to do is update the software and I'm good to go. Just like any other buffer overflow.
Actually I don't use Kerberos at all, so it really doesn't matter. But the title really caught my attention..
Hrm....I haven't noticed anything about this on Bugtraq or Full-Disclosure, and you'd think that something this big would be all over those lists about two or three days before it got posted here. I'll believe this when I see a proof-of-concept.
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
So is there an exploit making the rounds yet? It seems that these people are working on a Crackall ready.
Okay, so there's a root exploit in kerberos. SHocking, I'm sure. It's not like M$ Outlook doesn't have dozens of such exploits. It's been widely publicized, the patch is available...isn't this how security administration is supposed to work?
Is this just a warning of a potential hole.
Or has somebody actually made an exploit.
Does anybody know of a warez site from which I can get the security patch for free.
134340: I am not a number. I am a free planet!
Well, Microsoft is currently working on their own implementation of Kerberos, Microsoft Kerberos. I've seen about a half-dozen root exploits for MIT kerberos, but none yet for MS kerb. I guess this is really a first for the boys in blue. ;]
"Quoting famous computer scientists out of context is the root of all evil (or at least most of it) in programming." - K
glad to see you finally moved off of novell netware
Stack overflow, stack overflow... Better create an architecture and/or compiler where is NO stack at all! Be much more secure then.
---
How is everybody spent todays' slashdot meetup?
The patch is available here.
From our friends at MIT: Kerberos: The Network Authentication Protocol
A speech...
When viewing the journal of a friend of a friend, instead of seeing their username in the bar above (e.g. FortKnox's Journal) I just see "Friend of Friend's Journal". FUCKING FIX IT, FCUKERS!
So basically, all you have to do to avoid the vulnerability is just not run kadmind4, correct? I certainly can't speak for other KDC admins, but I haven't had much of a use for krb4 compatibility for a long time now - I disabled it at LEAST a year ago. Are there still many systems and/or applications that don't support Kerberos5? In any event, yay for me, my KDCs are unaffected!
Buffer overflows are wholly in implementation, never in specification.
I mean, they exist only within the program that they effect. All that a buffer overflow is is that someone was writing a program, and they put in some place that they read a value from one place and put it in another-- say, they have a web server, and they recieve some data from the client requesting a web page. And let's say that when they accept this data, they're going to put it into a little memory space that can hold 2000 bytes. A buffer overflow would be what would happen if the web client sent more than 2000 bytes of data, maybe 3000 bytes, and the program stupidly attempted to fit all 3000 bytes into that 2000 byte space. What you get is a buffer overflow; quite literally, that 2000-byte buffer "overflows", spilling an extra 1000 bytes of data into memory. The problem is that those 1000 bytes of memory it overwrites could quite possibly contain very important things. So if you exploit a buffer overflow by accident, say by sending a server more information than it can handle, you'll probably get a crash. But if you know a bit about the way that the program with the buffer overflow bug works, you can do some kind of clever things-- for example, you could send 3000 bytes, but very carefully sculpt those last 1000 bytes so that the program keeps running, doesn't crash, but suddenly has a bunch of your information in its memory. Do this right (hulk smash stack! smash!), and you can
literally send a very small program into the memory of the server and trick the server into running this program.
Now, this is a programming error; you can't build a buffer overflow into a protocol. Why? Because it's just a programming error. In our example above, the programmer of the web server made the mistake of not taking steps to prevent a buffer overflow. And preventing a buffer overflow is *easy*; you just make sure that whenever you copy data from one place to another, that you never put into a single memory space more data than it can hold. Like, you're writing that web server, and you have a network socket through which the client is sending you a request? Use fgets(SOCKET, space, 2000); instead of gets(SOCKET, space); (i think that's the right syntax). fgets() is a special version of gets(), with the special condition that you can give it a number of bytes and say "if the data coming in from this filehandle is more than this number of bytes, i don't want you to give me the rest". So fgets() will just read in 2000 characters and then stop, preventing a buffer overflow. It's that simple, you just carefully pick the ways in which you copy memory. the problem is that C is hard and people are lazy and people keep doing things like using gets() and lazily coding their fscanf() statements.
Now, there is one sort-of-exception to my "you can't code a buffer overflow into a protocol" rule: AOL actually did! That is to say, at one point AOL was trying to figure out how to lock Jabber and MSN users out of using the OSCAR protocol to access AOL instant messenger. (Third party clients are supposed to use TOC instead.) So AOL looked at their program and realized, hey, we accidentally put this buffer overflow in this one place in our AIM client, and neither MSN or jabber have that overflow. So (and they may have undone this change since then, i don't know, it was a wierd month) they changed the OSCAR protocol to the point where you literally can't connect to AOL instant messenger without that buffer overflow there! Becuase the OSCAR server would buffer-overflow-attack the AIM client, and send it code where, if the overflow was successful, the AIM client would send back a specific packet. If the OSCAR server didn't get this packet, it would disconnect you. Creepy, huh? Now, this wasn't very unsafe, becuase the way that the client was set up the only way that the buffer overflow could be exploited was by data recieved from AOL's computers.. but, then, it was also pretty stupid, becuase the buffer overflow was still exploitable by someone doing a man-in-the-middle attack and impersonating AOL's servers!
But, uh, yeah, that story doesn't have anything to do with backward-compatibility. kerberos didn't have to have the buffer overflow to bebackward compatible, that just isn't the way protocols work. i am guessing the overflow cropped up in backward-compatibility code because one, backward-compatibility code is usually really, really nasty and hard to debug, and two, it's possible that the backward-compatibility code in v5 could have been largely copied out of v4, and the code with the buffer overflow copied along with it.
That answer your question any?
Yeah. You see? you see all this typing above?? this is the extents i will go to to find some distraction so that i don't actually have to do my homework. God, remind me never to go to grad school, i'd never get my thesis even started.
--super ugly ultraman
Imagine being a sysadmin at MIT, having to replace/patch versions of Kerberos on every single computer... Ouch! Send that Mountain Dew in!
(Yes, I'm aware that they probably have lots of undergrads helping. Still, the concept is quite large.)
I'm the Devil the Windows users warned you about.
Actually, this security advisory (from the list) states that "Serious buffer overruns exist in krb4 compatibility code." It's not dated, but from reading it, it must be from at least six patches ago.
In other words, this latest advisory is the *first* specific bug of this type found since the problem was first discovered (and numerous other bugs of this type have presumably been fixed by now).
I think it's safe to assume that it won't be the last, so if you really want to be secure, take the original advisory to heart and avoid krb4 compatibility code.
If only we were all using Windows this could have been avoided. :(
NO CARRIER
Just a slight nitpick, but AFAIK, Kerberos never used any public key cryptography at all, Diffie-Hellman or otherwise. They use the Needham-Schroeder key exchange protocol which only requires symmetric key cryptography.
Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre.
It doesn't matter what you do...some part of your security solution is going be broken by some hackers at some point. Get used to it, deal with it.
Me, I spend the money my boss gives me for security on beer and better video cards for my office mates that like unreal tournament.
Oh, I should also mention that in addition to not providing any type of network secuity you must also not supply any type of network monitoring. Can you imagine...you're two frags from godlike and some system monitor (that you don't understand anyway) starts paging your beeper like a crazy x-girlfriend.
You might just lose concentration.
Here before all but 8486 of you.
I wonder how much you could do before you got noticed, but even if you managed to copy over the encrypted password files, I'm sure you could find some that fell to cracking software.
The ramifications of a flaw in a kerberos implementation is a great deal more important than a flaw in outlook. (The importance of this though means this flaw is probably going to be patched faster than a speeding bullet!)
Critical Kerberos Flaw Revealed
That would lead me to believe that a critical flaw in Kerberos itself was discovered, as in a flaw in the design. Critical Kerberos Exploit Revealed might have been more suitable, but at first I thought Kerberos was essentially broken.
Whew.
..There's a-dooin's a-transpirin'
Unless you need backward compatibility with Kerberos v4 (most people should use v5 nowadays), disable it.
Lose kadmin4 and disable starting krb524d in /etc/init.d/
If we're going to have articles on what dangerous server rooms look like, we can have an article on how if you don't patch that KDC server fast, tens of thousands of user accounts might be compromised. Kerberos is at the HEART of many large multi-user distributed systems. (Universities, hospitals...) A critical flaw possibly compromising hundreds of thousands of accounts worldwide is a big story.
well, it's a bit redundant...
today is the (car (cdr life)) would be better, or maybe
(define today (car (cdr life)))
I've been here a long time, and that is the most brilliant sig I've ever seen. Hardly. It's syntactically meaningless. It should be "Today is the (car (the rest of your life))" or, if you life is subdivided betweeen the past and the future, then "Today is the (car (cdr (your life)))." Learn some lisp fool. Both of you.
I use kerberoes and I have these packages installed:
krb5-libs-1.1.1-29
krb5-configs-1.1.1-29
krb5-devel-1.1.1-29
Where can I get a security fix?
"With Microsoft, you get Windows. With Linux, you get the full house" - unknown
"We're smart, we're careful, we can write code in C that doesn't have buffer overflows." Yeah, right. If MIT hackers can't do it, if Microsoft can't do it, who can?
If you did your thesis on buffer overflows, you'd be halfway done already.
Dude.
If a halfassed potential everything2 writeup was all you needed for it to qualify as a thesis, i'd have graduated grad school already.
--super ugly ultraman
Its pronounced Gnu/kerberos
http://saveie6.com/
How many "eyes" have looked over the code in those 15 years and haven't seen it?
I'm not trying to get into an open source vs closed source fight here. It's just that the open source guys always say that their code is more secure because they have more eyes looking at it. If that was true shouldn't this flaw of been uncovered earlier?
I hope the author hasn't planned a holiday in the land of the free!
Some in america is *bound* to be using this to protect copyright material.
In the free world the media isn't government run; the government is media run.
Indeed, I thought exactly the same.
To make things less ambiguous it would be better if such problems were referred to as a bug (an implementation problem) rather than a flaw (an inherent problem)
Obsd uses Heimdal, and seemingly the krb4 compatiblity is built into the kadmind daemon. Only MIT-based sites running the kadmind4 daemon are affected, while seemingly all heimdal KDC's running kadmind were. In any case the code flaw in both cases has a similar patch / fix.
Linux is Linux, if One need clarify their dist: <Dist>/GNU Linux
bsds are of course just BSD
I'm curious to know how these buffer overflow exploits are typically found? Does somebody go through the source (if ineed it is avaiable) and look for potential buffers to overflow? Or is it more like they go through the whole inerface to the thing and check everywhere where they can give some input and see if thy can cause an overflow that way?
It's preposterous that we should be constantly victimized by stack-smashing attacks over and over and over to the end of time. Best cure would be languages and/or systems where this is not possible. The damn stack grows the wrong way! Why the @#&! can the data stack be executed anyway!?! The friggin' architecture needs to be overhauled. Not holding my breath, though.
A buffer stack overflow allows an attacker to use a specially formed request to gain access...
*ENERGIZER BUNNY*
ON and ON and ON and ON.......
How about Secure Client Authentication and Manipulation Protocol (The SCAM protocol)?
By the way, this interacts with the Quantum Computing discussion threads, because if it's possible to factor big numbers, public-key crypto no longer works, so the fallback for authentication is to use symmetric-key systems like kerberos.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Listen, I know as of late /. has become a very politcal-oriented site, tech news abut new laws, etc.
This type of story has it's roots here long before the DMCA was a twinkle in Congress' eye. THis is an important story, about an important flaw in VERY important security software. If this type of story isn't fit for Slashdot, then Slashdot is no longer a tech. news site.
"News for Nerds, Stuff That Matters."
This fscking matter. A lot. As user # 318124, though, maybe you havent' been around long enough to realize that.
-1 Redundant. I have the karma to burn.
CAn'T CompreHend SARcaSm?
Do you have kadmind4 installed, though?
I have access to several boxes, all with Kerberos 5 on them, but none of them have kadmind4 (not in any bin directories or in inetd, at least).
If you do have kadmind4, go to CIAC.
Specifically, go here