CVE-2017-11462

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances (CVE-2017-7562). Note that this issue only affects Mageia 6.

RFC 2744 permits a GSS-API implementation to delete an existing security context on a second or subsequent call to gss_init_sec_context() or gss_accept_sec_context() if the call results in an error. This API behavior has been found to be dangerous, leading to the possibility of memory errors in some callers. For safety, GSS-API implementations should instead preserve existing security contexts on error until the caller deletes them (CVE-2017-11462).

A buffer overflow vulnerability was found in get_matching_data() function when both the CA cert and the user cert have a long subject affecting krb5 that includes certauth plugin. Attack requires a validated certificate with a long subject and issuer, and a "pkinit_cert_match" string attribute on some principal in the database. A remote code execution exploit might also require that the attacker gets to choose the contents of the issuer in the validated cert (CVE-2017-15088).

These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.

This update for krb5 fixes several issues.

This security issue was fixed:

• CVE-2017-11462: Prevent automatic security context deletion to prevent double-free (bsc#1056995)

These non-security issues were fixed:

• Set 'rdns' and 'dns_canonicalize_hostname' to false in krb5.conf in order to improve client security in handling service principle names. (bsc#1054028)
• Prevent kadmind.service startup failure caused by absence of LDAP service. (bsc#903543)
• Remove main package's dependency on systemd (bsc#1032680)

This update for krb5 fixes several issues.

This security issue was fixed:

• CVE-2017-11462: Prevent automatic security context deletion to prevent double-free (bsc#1056995).
• CVE-2018-5729: Null pointer dereference in kadmind or DN container check bypass by supplying special crafted data (bsc#1083926).
• CVE-2018-5730: DN container check bypass by supplying special crafted data (bsc#1083927).

This non-security issue was fixed:

• Avoid indefinite polling in KDC communication. (bsc#970696)