1. Forum
  2. Usenet
  3. COMP.UNIX.BSD.FREEBSD.ANN

  • [FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-17:05.heimdal

    From FreeBSD Security Advisories@21:1/5 to All on Wed Jul 12 16:00:00 2017
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    ============================================================================= FreeBSD-SA-17:05.heimdal Security Advisory
    The FreeBSD Project

    Topic: heimdal KDC-REP service name validation vulnerability

    Category: contrib
    Module: heimdal
    Announced: 2017-07-12
    Affects: All supported versions of FreeBSD.
    Corrected: 2017-07-12 07:26:07 UTC (stable/11, 11.1-PRERELEASE)
    2017-07-12 08:07:16 UTC (releng/11.1, 11.1-RC2-p1)
    2017-07-12 08:07:16 UTC (releng/11.1, 11.1-RC1-p1)
    2017-07-12 07:26:07 UTC (stable/11, 11.1-BETA3-p1)
    2017-07-12 08:07:36 UTC (releng/11.0, 11.0-RELEASE-p11)
    2017-07-12 07:26:07 UTC (stable/10, 10.3-STABLE)
    2017-07-12 15:16:01 UTC (releng/10.3, 10.3-RELEASE-p20)
    CVE Name: CVE-2017-11103

    For general information regarding FreeBSD Security Advisories,
    including descriptions of the fields above, security branches, and the following sections, please visit <URL:https://security.FreeBSD.org/>.

    I. Background

    Heimdal implements the Kerberos 5 network authentication protocols.
    The Kerberos protocol uses "tickets" to authenticate a client to a
    service.

    A Key Distribution Center (KDC) is trusted by all principals registered
    in that administrative "realm" to store a secret key in confidence, of
    which, the proof of knowledge is used to verify the authenticity of a principal.

    II. Problem Description

    There is a programming error in the Heimdal implementation that used an unauthenticated, plain-text version of the KDC-REP service name found
    in a ticket.

    III. Impact

    An attacker who has control of the network between a client and the
    service it talks to will be able to impersonate the service, allowing
    a successful man-in-the-middle (MITM) attack that circumvents the mutual authentication.

    IV. Workaround

    No workaround is available, but only Kerberos enabled clients are
    affected.

    V. Solution

    Perform one of the following:

    1) Upgrade your vulnerable system to a supported FreeBSD stable or
    release / security branch (releng) dated after the correction date.

    A reboot is recommended.

    2) To update your vulnerable system via a binary patch:

    Systems running a RELEASE version of FreeBSD on the i386 or amd64
    platforms can be updated via the freebsd-update(8) utility:

    # freebsd-update fetch
    # freebsd-update install

    A reboot is recommended.

    3) To update your vulnerable system via a source code patch:

    The following patches have been verified to apply to the applicable
    FreeBSD release branches.

    a) Download the relevant patch from the location below, and verify the
    detached PGP signature using your PGP utility.

    # fetch https://security.FreeBSD.org/patches/SA-17:05/heimdal.patch
    # fetch https://security.FreeBSD.org/patches/SA-17:05/heimdal.patch.asc
    # gpg --verify heimdal.patch.asc

    b) Apply the patch. Execute the following commands as root:

    # cd /usr/src
    # patch < /path/to/patch

    c) Recompile the operating system using buildworld and installworld as described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.

    Restart all daemons that use the library, or reboot the system.

    VI. Correction details

    The following list contains the correction revision numbers for each
    affected branch.

    Branch/path Revision
    - ------------------------------------------------------------------------- stable/10/ r320907 releng/10.3/ r320915 stable/11/ r320907 releng/11.0/ r320911 releng/11.1/ r320910
    - -------------------------------------------------------------------------

    To see which files were modified by a particular revision, run the
    following command, replacing NNNNNN with the revision number, on a
    machine with Subversion installed:

    # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base

    Or visit the following URL, replacing NNNNNN with the revision number:

    <URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>

    VII. References

    <URL:https://www.orpheus-lyre.info/>

    <URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11103>

    The latest revision of this advisory is available at <URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-17:05.heimdal.asc> -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v2.1.21 (FreeBSD)

    iQIzBAEBCgAdFiEEHPf/b631yp++G4yy7Wfs1l3PaucFAllmPXgACgkQ7Wfs1l3P audcIhAAz/QvL+4RPmTUvCLi8apSyHUCIlgiazrip0k77AQ19k9iLljJJijZu/ol 4f4VPmBh2iAiBsxvALvhljIEQnj4ApeAQrkqzY8ims/4SPJlYw0mBzchAnaJ8MzK 6UbQLWtqfhK67GXnjxXOtUa8LXno4GgOaeaFYYtf3Px0QHoJlMgQ6u1F5upReBur Ux5PGm3aRnjz124ZyW23wdAlZ5I8Y+hWcRQkyfTkFajIBrSjG+VIz2cRbvu1su9N nwCbxFpDt+6qeatmIsfSj7RFcpyYwMwZJXgMcVc0nVR59XhYyya/4GVYu/3mLNpx hDgKoyHiM6olVkB+9mvRi07fjs333fHcRM3z6UeJtGHkCkdCMgm3vElkvi+ubenH vpCrJApOr/qklT/mqlpRuVJ/nlEa/ueyaP4zyi8ts7gM/0Hue+zelHRt7XsfAK6n pwwZqIrZQHq7sxyhaZxgCUb56wc8+O1cxXZK6qSE3DeoE5YYPSqcm5a5tZtLbxI+ e4Bt/DtonZfxS/UEiuSgrg8LAiYAakBh45rmSsMKvz5+fRN+ecPKyMCI//R7uI/c 7sSQnT7A3WC3yHDZDvcYs0XrKNWvv28lZZGM/aVxrPGAiOunijMgORZw4fkoeCFO MmcpIFvJ3LDmkngwmvZjj4gF6Wpw6Lav4zYQWG8NG1sjdciCUkw=
    =QQ1C
    -----END PGP SIGNATURE-----
    _______________________________________________
    freebsd-announce@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-announce
    To unsubscribe, send any mail to "freebsd-announce-unsubscribe@freebsd.org"

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)