Product
Solaris 9 Operating System
Solaris 10 Operating System
Solaris 8 Operating System

Bug Id
6591024

Date of Workaround Release
05-SEP-2007

Date of Resolved Release
22-OCT-2007

Impact

A stack overflow vulnerability in the RPCSEC_GSS (see rpcsec_gss(3NSL)) security flavor used to access the Generic Security Services Application Programming Interface (GSS-API) affects the Kerberos administration daemon (kadmind(1M)). This vulnerability may allow an unauthorized remote user the ability to execute arbitrary commands on Kerberos Key Distribution Center(KDC) systems with the privileges of the kadmind(1M) daemon (usually root). This may also allow the remote user to compromise the Kerberos key database or cause the kadmind(1M) daemon to crash, which is a type of Denial of Service (DoS).

Note: Third-party applications which utilize RPCSEC_GSS may also be affected.

This issue is also referenced in the following documents:

MITKRB5-SA-2007-006 at:

• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-006.txt

CVE-2007-3999 at:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999

Note: Solaris is not affected by CVE-2007-4000 mentioned in MITKRB5-SA-2007-006.

Contributing Factors

This issue can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 126928-02
• Solaris 9 without patch 113318-32
• Solaris 10 without patch 126661-02

x86 Platform

• Solaris 8 without patch 126929-02
• Solaris 9 without patch 117468-18
• Solaris 10 without patch 126662-02

Note: This issue only occurs if the system is configured as a Key Distribution Center (KDC).

To determine if the system is configured as a Key Distribution Center, the following command can be used:

    % pgrep -l kadmind
    938 kadmind

If the above command shows a process id, the daemon kadmind(1M) is running and the machine is configured as the Key Distribution Center (KDC).

Symptoms

There are no predictable symptoms that would indicate the described vulnerability has been exploited.

Workaround

There is no workaround.  Please see the Resolution section below.

Resolution

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 126928-02 or later
• Solaris 9 with patch 113318-32 or later
• Solaris 10 with patch 126661-02 or later

x86 Platform

• Solaris 8 with patch 126929-02 or later
• Solaris 9 with patch 117468-18 or later
• Solaris 10 with patch 126662-02 or later

Modification History
Date: 10-OCT-2007

• Updated Relief/Workaround section

Date: 16-OCT-2007

• Updated Contributing Factors, Relief/Workaround, and Resolution sections

Date: 22-OCT-2007

• State: Resolved
• Updated Contributing Factors and Resolution sections

References

126662-02
126661-02
117468-18
113318-32
126928-02
126929-02




Attachments

This solution has no attachment