USN-2810-1: Kerberos vulnerabilities

12 November 2015

krb5 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 15.10
  • Ubuntu 15.04
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Kerberos.

Software Description

  • krb5 - MIT Kerberos Network Authentication Protocol

Details

It was discovered that the Kerberos kpasswd service incorrectly handled certain UDP packets. A remote attacker could possibly use this issue to cause resource consumption, resulting in a denial of service. This issue only affected Ubuntu 12.04 LTS. (CVE-2002-2443)

It was discovered that Kerberos incorrectly handled null bytes in certain data fields. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-5355)

It was discovered that the Kerberos kdcpreauth modules incorrectly tracked certain client requests. A remote attacker could possibly use this issue to bypass intended preauthentication requirements. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2694)

It was discovered that Kerberos incorrectly handled certain SPNEGO packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2695)

It was discovered that Kerberos incorrectly handled certain IAKERB packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2696, CVE-2015-2698)

It was discovered that Kerberos incorrectly handled certain TGS requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2697)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 15.10
krb5-admin-server - 1.13.2+dfsg-2ubuntu0.1
krb5-k5tls - 1.13.2+dfsg-2ubuntu0.1
krb5-kdc - 1.13.2+dfsg-2ubuntu0.1
krb5-kdc-ldap - 1.13.2+dfsg-2ubuntu0.1
krb5-otp - 1.13.2+dfsg-2ubuntu0.1
krb5-pkinit - 1.13.2+dfsg-2ubuntu0.1
krb5-user - 1.13.2+dfsg-2ubuntu0.1
libgssapi-krb5-2 - 1.13.2+dfsg-2ubuntu0.1
libgssrpc4 - 1.13.2+dfsg-2ubuntu0.1
libk5crypto3 - 1.13.2+dfsg-2ubuntu0.1
libkadm5clnt-mit9 - 1.13.2+dfsg-2ubuntu0.1
libkdb5-8 - 1.13.2+dfsg-2ubuntu0.1
libkrad0 - 1.13.2+dfsg-2ubuntu0.1
libkrb5-3 - 1.13.2+dfsg-2ubuntu0.1
libkrb5support0 - 1.13.2+dfsg-2ubuntu0.1
Ubuntu 15.04
krb5-admin-server - 1.12.1+dfsg-18ubuntu0.1
krb5-kdc - 1.12.1+dfsg-18ubuntu0.1
krb5-kdc-ldap - 1.12.1+dfsg-18ubuntu0.1
krb5-otp - 1.12.1+dfsg-18ubuntu0.1
krb5-pkinit - 1.12.1+dfsg-18ubuntu0.1
krb5-user - 1.12.1+dfsg-18ubuntu0.1
libgssapi-krb5-2 - 1.12.1+dfsg-18ubuntu0.1
libgssrpc4 - 1.12.1+dfsg-18ubuntu0.1
libk5crypto3 - 1.12.1+dfsg-18ubuntu0.1
libkadm5clnt-mit9 - 1.12.1+dfsg-18ubuntu0.1
libkdb5-7 - 1.12.1+dfsg-18ubuntu0.1
libkrad0 - 1.12.1+dfsg-18ubuntu0.1
libkrb5-3 - 1.12.1+dfsg-18ubuntu0.1
libkrb5support0 - 1.12.1+dfsg-18ubuntu0.1
Ubuntu 14.04 LTS
krb5-admin-server - 1.12+dfsg-2ubuntu5.2
krb5-kdc - 1.12+dfsg-2ubuntu5.2
krb5-kdc-ldap - 1.12+dfsg-2ubuntu5.2
krb5-otp - 1.12+dfsg-2ubuntu5.2
krb5-pkinit - 1.12+dfsg-2ubuntu5.2
krb5-user - 1.12+dfsg-2ubuntu5.2
libgssapi-krb5-2 - 1.12+dfsg-2ubuntu5.2
libgssrpc4 - 1.12+dfsg-2ubuntu5.2
libk5crypto3 - 1.12+dfsg-2ubuntu5.2
libkadm5clnt-mit9 - 1.12+dfsg-2ubuntu5.2
libkdb5-7 - 1.12+dfsg-2ubuntu5.2
libkrad0 - 1.12+dfsg-2ubuntu5.2
libkrb5-3 - 1.12+dfsg-2ubuntu5.2
libkrb5support0 - 1.12+dfsg-2ubuntu5.2
Ubuntu 12.04 LTS
krb5-admin-server - 1.10+dfsg~beta1-2ubuntu0.7
krb5-kdc - 1.10+dfsg~beta1-2ubuntu0.7
krb5-kdc-ldap - 1.10+dfsg~beta1-2ubuntu0.7
krb5-pkinit - 1.10+dfsg~beta1-2ubuntu0.7
krb5-user - 1.10+dfsg~beta1-2ubuntu0.7
libgssapi-krb5-2 - 1.10+dfsg~beta1-2ubuntu0.7
libgssrpc4 - 1.10+dfsg~beta1-2ubuntu0.7
libk5crypto3 - 1.10+dfsg~beta1-2ubuntu0.7
libkadm5clnt-mit8 - 1.10+dfsg~beta1-2ubuntu0.7
libkdb5-6 - 1.10+dfsg~beta1-2ubuntu0.7
libkrb5-3 - 1.10+dfsg~beta1-2ubuntu0.7
libkrb53 - 1.10+dfsg~beta1-2ubuntu0.7
libkrb5support0 - 1.10+dfsg~beta1-2ubuntu0.7

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary changes.

References