From ellidz@eridu.uchicago.edu Thu Sep 23 11:55:18 1999
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id LAA17955 for <bugs@RT-11.MIT.EDU>; Thu, 23 Sep 1999 11:55:14 -0400
Received: from eridu.uchicago.edu by MIT.EDU with SMTP
id AA20330; Thu, 23 Sep 99 11:55:15 EDT
Received: (from ellidz@localhost)
by eridu.uchicago.edu (8.9.3/8.9.3) id KAA18457;
Thu, 23 Sep 1999 10:54:34 -0500 (CDT)
Message-Id: <199909231554.KAA18457@eridu.uchicago.edu>
Date: Thu, 23 Sep 1999 10:54:34 -0500 (CDT)
From: "E. Larry Lidz" <ellidz@eridu.uchicago.edu>
Reply-To: ellidz@eridu.uchicago.edu
To: krb5-bugs@MIT.EDU
Subject: krb5kdc dropped core, apparently when it got a confused packet
X-Send-Pr-Version: 3.99
System: SunOS 5.7 Generic_106541-05 sun4u sparc SUNW,Ultra-5_10
Architecture: sun4
like there was a bad AS Request or something that went to the KDC,
crashed it, realized that it wasn't getting a response, and moved on to
the first slave, and so forth until it had crashed all three of our
KDCs. If the packet could be constructed intentionally (we don't have a
reason to believe that it was), it could lead to a potentially quite
nasty Denial-of-Service attack.
I don't know how to repeat it, but here's a little bit of information
that I've gleamed from the core files that were left behind. The crash
occured when trying to log a request (it doesn't look like the request
was actually ever logged, though). The log line was line 430 of
do_as_req.c. fromstring was \023, portnum was 750, status was a few
lines of garbage. cname was out of bounds, sname was a few lines of
garbage. errcode was 501984.
Unknown.
From: "E. Larry Lidz" <ellidz@eridu.uchicago.edu>
To: krb5-bugs@MIT.EDU, krb5-unassigned@RT-11.MIT.EDU
Cc: Subject: Re: krb5-kdc/754: krb5kdc dropped core, apparently when it got a confused packet
Date: Thu, 23 Sep 1999 11:41:08 -0500
krb5-bugs@mit.edu writes:
I've been able to track this down a bit further. Apparently the KDC
drops core if "%n" (without the quotes) appears anywhere in the
prinicpal name. (In our case the principal name came in from the modem
pool and was, probably, line noise. However, someone could
intentionally crash KDCs using this).
-Larry
State-Changed-From-To: open-closed
State-Changed-By: tlyu
State-Changed-When: Thu Sep 13 23:36:49 2001
State-Changed-Why:
fixed this class of bugs quite some time ago, likely 1.1.x
Received: from MIT.EDU (PACIFIC-CARRIER-ANNEX.MIT.EDU [18.69.0.28]) by rt-11.MIT.EDU (8.7.5/8.7.3) with SMTP id LAA17955 for <bugs@RT-11.MIT.EDU>; Thu, 23 Sep 1999 11:55:14 -0400
Received: from eridu.uchicago.edu by MIT.EDU with SMTP
id AA20330; Thu, 23 Sep 99 11:55:15 EDT
Received: (from ellidz@localhost)
by eridu.uchicago.edu (8.9.3/8.9.3) id KAA18457;
Thu, 23 Sep 1999 10:54:34 -0500 (CDT)
Message-Id: <199909231554.KAA18457@eridu.uchicago.edu>
Date: Thu, 23 Sep 1999 10:54:34 -0500 (CDT)
From: "E. Larry Lidz" <ellidz@eridu.uchicago.edu>
Reply-To: ellidz@eridu.uchicago.edu
To: krb5-bugs@MIT.EDU
Subject: krb5kdc dropped core, apparently when it got a confused packet
X-Send-Pr-Version: 3.99
Show quoted text
>Number: 754
>Category: krb5-kdc
>Synopsis: krb5kdc dropped core, apparently when it got a confused packet
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: krb5-unassigned
>State: closed
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Thu Sep 23 11:56:01 EDT 1999
>Last-Modified: Thu Sep 13 23:37:11 EDT 2001
>Originator: E. Larry Lidz
>Organization:
>Release: krb5-1.0.6
>Environment:
Solaris 7 5/99, Kerberos 1.0.6. We run without krb4 support in the KDC.>Category: krb5-kdc
>Synopsis: krb5kdc dropped core, apparently when it got a confused packet
>Confidential: no
>Severity: critical
>Priority: high
>Responsible: krb5-unassigned
>State: closed
>Class: sw-bug
>Submitter-Id: unknown
>Arrival-Date: Thu Sep 23 11:56:01 EDT 1999
>Last-Modified: Thu Sep 13 23:37:11 EDT 2001
>Originator: E. Larry Lidz
>Organization:
>Release: krb5-1.0.6
>Environment:
System: SunOS 5.7 Generic_106541-05 sun4u sparc SUNW,Ultra-5_10
Architecture: sun4
Show quoted text
>Description:
All three KDCs that we have just dropped core simultaneously. It lookslike there was a bad AS Request or something that went to the KDC,
crashed it, realized that it wasn't getting a response, and moved on to
the first slave, and so forth until it had crashed all three of our
KDCs. If the packet could be constructed intentionally (we don't have a
reason to believe that it was), it could lead to a potentially quite
nasty Denial-of-Service attack.
Show quoted text
>How-To-Repeat:
I don't know how to repeat it, but here's a little bit of information
that I've gleamed from the core files that were left behind. The crash
occured when trying to log a request (it doesn't look like the request
was actually ever logged, though). The log line was line 430 of
do_as_req.c. fromstring was \023, portnum was 750, status was a few
lines of garbage. cname was out of bounds, sname was a few lines of
garbage. errcode was 501984.
Show quoted text
>Fix:
Unknown.
Show quoted text
>Audit-Trail:
From: "E. Larry Lidz" <ellidz@eridu.uchicago.edu>
To: krb5-bugs@MIT.EDU, krb5-unassigned@RT-11.MIT.EDU
Cc: Subject: Re: krb5-kdc/754: krb5kdc dropped core, apparently when it got a confused packet
Date: Thu, 23 Sep 1999 11:41:08 -0500
krb5-bugs@mit.edu writes:
Show quoted text
>Thank you very much for your problem report.
>It has the internal identification `krb5-kdc/754'.
>The individual assigned to look at your
>report is: krb5-unassigned.
>
>It has the internal identification `krb5-kdc/754'.
>The individual assigned to look at your
>report is: krb5-unassigned.
>
>>Category: krb5-kdc
>>Responsible: krb5-unassigned
>>Synopsis: krb5kdc dropped core, apparently when it got a confused packe
>t>>Responsible: krb5-unassigned
>>Synopsis: krb5kdc dropped core, apparently when it got a confused packe
>>Arrival-Date: Thu Sep 23 11:56:01 EDT 1999
I've been able to track this down a bit further. Apparently the KDC
drops core if "%n" (without the quotes) appears anywhere in the
prinicpal name. (In our case the principal name came in from the modem
pool and was, probably, line noise. However, someone could
intentionally crash KDCs using this).
-Larry
State-Changed-From-To: open-closed
State-Changed-By: tlyu
State-Changed-When: Thu Sep 13 23:36:49 2001
State-Changed-Why:
fixed this class of bugs quite some time ago, likely 1.1.x
Show quoted text
>Unformatted: