The Channel logo

News

By | John Leyden 20th March 2008 11:44

Critical bugs bite Kerberos

Hell's fire

Multiple critical vulnerabilities have been discovered in version five of the widely-used Kerberos authentication protocol. The most serious of the bugs create a means to either compromise or crash vulnerable systems.

Exploits are yet to surface and patches are available. All releases of MIT Kerberos 5 up to and including krb5-1.6.3 are affected.

Two of the bugs involve errors in processing krb4 requests in MIT Kerberos 5 implementation's Key Distribution Center (KDC) program and libraries. The flaws create a possible mechanism for hackers to execute arbitrary code on targeted systems.

A further two bugs in the Kerberos RPC library, involving the handling of open file descriptors, might be exploited to cause memory corruption.

Developers are advised to update to version krb5-1.6.4 or apply workarounds.

A overview of the bugs by security clearing house Secunia can be found here. A summary of the products affected - along with responses from vendors - has been published by US CERT here and here.

Kerberos was developed by MIT and is a popular means for securely authenticating a request for a service in a computer network. The name derives from Greek mythology, where Cerberus is the three-headed dog guarding the gates of Hades. ®

alert Send corrections

Opinion

Trevor Pott

Why aren't you, personally, stopping the moronocalypse?
Star Trek Into Darkness

Chris Mellor

Federation fissiparousness to form co-ordinated divisions
iot_internet_of_things

Chris Mellor

EMC is ahead overall with HDS mounting an IoT catch-up

Features

Lego gandalf by https://www.flickr.com/photos/isherwoodchris/  CC 2.0 https://creativecommons.org/licenses/by-sa/2.0/ attribution sharealike
Why interconnectivity in the cloud is tougher than just stacking bricks
Handing over dollars picture via Shutterstock
Steve Ballmer. Pic:  Aanjhan Ranganathan
Nokia is the biggest write-off yet, but it wasn't the first
Confused computer keyboard
Last Christmas, I gave you my Cloud, the very next day you gave it away