[ISN] Security pros warn of critical flaws in Kerberos

[InfoSec News]

http://news.com.com/Security+pros+warn+of+critical+flaws+in+Kerberos/2100-1002_3-5343325.html

By Robert Lemos 
Staff Writer, CNET News.com
September 1, 2004

Vulnerabilities in a technology widely used for network authentication
have left computers running Unix, Linux and Apple Computer's Mac OS X
potentially open to attack.

The flaws could allow an online intruder to gain access to computers
running a security feature known as Kerberos. The vulnerabilities,
found by the developers at the Kerberos Team at the Massachusetts
Institute of Technology, should be patched as soon as possible, Sam
Hartman, engineering lead for the team, said Wednesday.

"I would not expect this to lead to a worm," Hartman said. "Most sites
will patch it because patching is easy to do. Whereas, if you do have
a compromise, it is a lot of work to recover."

Kerberos is the keystone to security for many networks. The software
essentially acts as a gatekeeper, identifying the people who are
allowed to access computers in the network and those who are not. That
makes the software flaws particularly pernicious.

The flaws, known as double-free vulnerabilities, are caused because a
part of the program attempts to free up the same computer memory space
twice. Such errors are not as easy to take advantage of as another,
more common memory error--the buffer overflow. That gives
administrators a little breathing room, Hartman said.

"We have no reason to believe that anyone has produced an exploit
program," he said. "Moreover, this is not something where we have seen
an attack in the wild."

Kerberos is a building block of many network security devices and
software. Microsoft uses the mechanism to control security in its
Active Directory authentication. However, the company uses a homegrown
version of Kerberos that is not affected by the flaws, Hartman said.

However, Sun Microsystems' Solaris, Linux from Red Hat and Mandrake,
and OS X all use Kerberos. Some companies, such as Red Hat, have
announced patches for the problem, but not all have.

[...]