From ellidz@eridu.uchicago.edu  Thu Sep 23 11:55:18 1999
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id LAA17955 for <bugs@RT-11.MIT.EDU>; Thu, 23 Sep 1999 11:55:14 -0400
Received: from eridu.uchicago.edu by MIT.EDU with SMTP
	id AA20330; Thu, 23 Sep 99 11:55:15 EDT
Received: (from ellidz@localhost)
	by eridu.uchicago.edu (8.9.3/8.9.3) id KAA18457;
	Thu, 23 Sep 1999 10:54:34 -0500 (CDT)
Message-Id: <199909231554.KAA18457@eridu.uchicago.edu>
Date: Thu, 23 Sep 1999 10:54:34 -0500 (CDT)
From: "E. Larry Lidz" <ellidz@eridu.uchicago.edu>
Reply-To: ellidz@eridu.uchicago.edu
To: krb5-bugs@MIT.EDU
Subject: krb5kdc dropped core, apparently when it got a confused packet
X-Send-Pr-Version: 3.99

>Number:         754
>Category:       krb5-kdc
>Synopsis:       krb5kdc dropped core, apparently when it got a confused packet
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    krb5-unassigned
>State:          closed
>Class:          sw-bug
>Submitter-Id:   unknown
>Arrival-Date:   Thu Sep 23 11:56:01 EDT 1999
>Last-Modified:  Thu Sep 13 23:37:11 EDT 2001
>Originator:     E. Larry Lidz
>Organization:
>Release:        krb5-1.0.6
>Environment:
Solaris 7 5/99, Kerberos 1.0.6. We run without krb4 support in the KDC.
System: SunOS 5.7 Generic_106541-05 sun4u sparc SUNW,Ultra-5_10
Architecture: sun4

>Description:
All three KDCs that we have just dropped core simultaneously. It looks
like there was a bad AS Request or something that went to the KDC,
crashed it, realized that it wasn't getting a response, and moved on to
the first slave, and so forth until it had crashed all three of our
KDCs. If the packet could be constructed intentionally (we don't have a
reason to believe that it was), it could lead to a potentially quite
nasty Denial-of-Service attack.

>How-To-Repeat:

I don't know how to repeat it, but here's a little bit of information
that I've gleamed from the core files that were left behind. The crash
occured when trying to log a request (it doesn't look like the request
was actually ever logged, though). The log line was line 430 of
do_as_req.c. fromstring was \023, portnum was 750, status was a few
lines of garbage. cname was out of bounds, sname was a few lines of
garbage. errcode was 501984.

>Fix:

Unknown.
>Audit-Trail:

From: "E. Larry Lidz" <ellidz@eridu.uchicago.edu>
To: krb5-bugs@MIT.EDU, krb5-unassigned@RT-11.MIT.EDU
Cc:  Subject: Re: krb5-kdc/754: krb5kdc dropped core, apparently when it got a confused packet 
Date: Thu, 23 Sep 1999 11:41:08 -0500

 krb5-bugs@mit.edu writes:
 >Thank you very much for your problem report.
 >It has the internal identification `krb5-kdc/754'.
 >The individual assigned to look at your
 >report is: krb5-unassigned. 
 >
 >>Category:       krb5-kdc
 >>Responsible:    krb5-unassigned
 >>Synopsis:       krb5kdc dropped core, apparently when it got a confused packe
 >t
 >>Arrival-Date:   Thu Sep 23 11:56:01 EDT 1999
 
 I've been able to track this down a bit further. Apparently the KDC
 drops core if "%n" (without the quotes) appears anywhere in the
 prinicpal name. (In our case the principal name came in from the modem
 pool and was, probably, line noise. However, someone could
 intentionally crash KDCs using this). 
 
 -Larry

State-Changed-From-To: open-closed
State-Changed-By: tlyu
State-Changed-When: Thu Sep 13 23:36:49 2001
State-Changed-Why:
fixed this class of bugs quite some time ago, likely 1.1.x

>Unformatted: