Software Engineering Institute

The MIT krb 5 krshd and v4rcp programs contain multiple privilege escalation vulnerabilities. MIT krb5 Security Advisory 2006-001 states that the vulnerabilities "...result when the OS implementations of setuid() or seteuid() can fail due to resource exhaustion when changing to an unprivileged user ID."

From MIT krb5 Security Advisory 2006-001:

The following vulnerabilities may result from unchecked calls to setuid(), and are believed to only exist on Linux and AIX:

• Unchecked calls to setuid() in krshd may allow a local privilege escalation leading to execution of programs as root.

• Unchecked calls to setuid() in the v4rcp may allow a local privilege escalation leading to reading, writing, or creating files as root. v4rcp is the remote end of a krb4-authenticated rcp operation, but may be executed directly by an attacker, as it is a setuid program.

An authenticated, remote attacker may be able to execute arbitrary code with root privileges.

Apply a patch or upgradeFrom MIT krb5 Security Advisory 2006-001: "The upcoming krb5-1.5.1 and krb5-1.4.4 releases will include fixes for these vulnerabilities." MIT has also released patches for krb 5-1.5 and krb5-1.4.3. See the Systems Affected section of this document for information about specific vendors.

Disable vulnerable programs

From MIT krb5 Security Advisory 2006-001: "Disable krshd and v4rcp, and remove the setuid bit from the ksu binary and the ftpd binary."