-----BEGIN PGP SIGNED MESSAGE-----


		 NetBSD Security Advisory 2002-026
		 =================================

Topic:		Buffer overflow in kadmind daemon

Version:	NetBSD-current:	source prior to October 21 2002
		NetBSD-1.6:	affected
		NetBSD-1.5.3:	affected
		NetBSD-1.5.2:	affected
		NetBSD-1.5.1:	affected
		NetBSD-1.5:	affected
		NetBSD-1.4.*:	not affected

Severity:	remote buffer overflow, resulting in root exploit

Fixed:		NetBSD-current:		October 22, 2002
		NetBSD-1.6 branch:	October 22, 2002
		NetBSD-1.5 branch:	October 22, 2002


Abstract
========

Kadmind is the server for administrative access to kerberos database,
and comes from the Heimdal Kerberos implementation used by NetBSD.  In
Heimdal releases earlier than 0.5.1 kadmind has a buffer overflow in
the kerberos version 4 compatibility code.

The kadmind daemon has never been enabled by default in NetBSD;
enabling it would require a change in /etc/inetd.conf.


Technical Details
=================

All versions prior to Heimdal 0.5.1 and 0.4enb1 are vulnerable.  NetBSD
1.5, 1.6, and -current (prior to October 21, 2002) ship with a vulnerable
version.

The problem is a buffer overflow in the kerberos version 4 compatibility layer
of kadmind.

See also: http://www.pdc.kth.se/heimdal/


Solutions and Workarounds
=========================

For most users this is not a vital service and is likely not enabled.
The only user of kadmin should be the kdc in a kerberos
realm.  Since the security of the kerberos server very important,
kadmind must be disabled until upgraded.

* NetBSD all releases:

        Check that you don't have kadmind in your /etc/inetd.conf.

        # grep kadmind /etc/inetd.conf

	If kadmind is enabled, disable it by commenting out its entry and
	reloading inetd:

	# /etc/rc.d/inetd reload

	Check that kadmind is not running as a service

	# ps axlwww | grep kadmind

	If kadmind is running, kill it:

	# kill <process id of kadmind>

* NetBSD-current:

	Systems running NetBSD-current dated from before 2002-Oct-22 should
	be upgraded to NetBSD-current dated 2002-Oct-22 or later.  The fix
	is included in crypto/dist/heimdal/kadmin/version4.c, revision 1.2.

	The following directory needs to be updated from the netbsd-current
	CVS branch (aka HEAD):
		crypto/dist/heimdal/kadmin

	To update from CVS, re-build, and re-install kadmind(8):
		# cd src
		# cvs update -d -P crypto/dist/heimdal
		# cd libexec/kadmind
		# make cleandir dependall
		# make install

* NetBSD 1.6:

	The following directory needs to be updated from the 
	netbsd-1-6 CVS branch:
		crypto/dist/heimdal/kadmin

	To update from CVS, re-build, and re-install kadmind(8):

		# cd src
		# cvs update -d -P -r netbsd-1-6 crypto/dist/heimdal/kadmin
		# cd libexec/kadmind
		# make cleandir dependall
		# make install

* NetBSD 1.5:

        The following directory needs to be updated from the
        netbsd-1-5 CVS branch:
                crypto/dist/heimdal/kadmin

        To update from CVS, re-build, and re-install kadmind(8):

                # cd src 
                # cvs update -d -P -r netbsd-1-5 crypto/dist/heimdal/kadmin
                # cd libexec/kadmind
                # make cleandir dependall 
                # make install

Thanks To
=========

Love Hoernquist-Astrand for the patch and notification and Johan Danielsson
for testing.


Revision History
================

	2002-Oct-21	Initial release

More Information
================

Advisories may be updated as new information comes to hand.  The most
recent version of this advisory (PGP signed) can be found at 
  ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2002-026.txt.asc

Information about NetBSD and NetBSD security can be found at
http://www.NetBSD.ORG/ and http://www.NetBSD.ORG/Security/.


Copyright 2002, The NetBSD Foundation, Inc.  All Rights Reserved.

$NetBSD: NetBSD-SA2002-026.txt,v 1.9 2002/10/21 20:34:06 groo Exp $

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (NetBSD)
Comment: For info see http://www.gnupg.org

iQCVAwUBPbRlij5Ru2/4N2IFAQGcgwQAn2bBxCdA6L0KhD5Pq0DzylaH8V5wHsq+
iguSkTTaj8cfIR/7Nz8LHUx16Sn9BzYM/YbGkHhp0NjasjIXxlL1ulriTly6Ynf1
SOLNqfHP4IlOITGvIYbFBV0EsIgQiRA4uW5jaQT15YJ/gWi8874wioHNWNRCuTm+
rmkN3qBFP04=
=2on8
-----END PGP SIGNATURE-----