Title : Kerberos V5 Kadmind RPC and GSS-API Modules Remote Code Execution Vulnerabilities VUPEN ID : VUPEN/ADV-2007-0111 CVE ID : CVE-2006-6143 - CVE-2006-6144
Rated as : Critical
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2007-01-09
Technical Description
Two vulnerabilities have been identified in MIT Kerberos, which could be exploited by remote attackers to take complete control of an affected system or cause a denial of service.
The first issue is due to memory management errors in the "svc_do_xprt()" [lib/rpc/svc.c] function within the administration daemon "kadmind", which could be exploited by remote unauthenticated attackers to execute arbitrary commands or crash a vulnerable application.
The second vulnerability is due to memory management errors in the "mechglue" abstraction interface of the GSS-API implementation and the administration daemon "kadmind" where the "log_badverf()" function calls "gss_display_name()" without checking its return value and without initializing the "gss_buffer_desc" structures passed to "gss_display_name()", which could be exploited by remote unauthenticated attackers to execute arbitrary commands or crash a vulnerable application.
