MITKRB5-SA-2010-006 [CVE-2010-1322] KDC uninitialized pointer crash in authorization data handling

Tom Yu tlyu at MIT.EDU
Tue Oct 5 15:34:59 EDT 2010

Hash: SHA1


MIT krb5 Security Advisory 2010-006
Original release: 2010-10-05

Topic: KDC uninitialized pointer crash in authorization data handling


CVSSv2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:C/E:H/RL:OF/RC:C

CVSSv2 Base Score:      8

Access Vector:          Network
Access Complexity:      Low
Authentication:         Single
Confidentiality Impact: Partial
Integrity Impact:       Partial
Availability Impact:    Complete

CVSSv2 Temporal Score:  7

Exploitability:         High
Remediation Level:      Official Fix
Report Confidence:      Confirmed


When the MIT krb5 KDC receives certain Kerberos TGS request messages,
it may dereference an uninitialized pointer while processing
authorization data, causing a crash, or in rare cases, unauthorized
information disclosure, ticket modification, or execution of arbitrary
code.  The crash may be triggered by legitimate requests.

This is an implementation vulnerability in MIT krb5, and not a
vulnerability in the Kerberos protocol.


An authenticated remote attacker can cause the MIT krb5 KDC process to
crash, resulting in a denial of service.  In rare cases, the attacker
can theoretically induce unauthorized information disclosure, ticket
modification, or the execution of arbitrary code.

The denial of service may be triggered by legitimate requests produced
by Windows Active Directory clients.  No exploit code is known to
exist that would cause information disclosure, ticket modification, or
arbitrary code execution.


* KDC in MIT krb5-1.8 through krb5-1.8.3

* Earlier releases of MIT krb5 did not contain the vulnerable code.


* The upcoming krb5-1.8.4 release will contain a fix for this

* Apply the following patch.  The patch was generated against

diff --git a/src/kdc/kdc_authdata.c b/src/kdc/kdc_authdata.c
index b5de64d..cc44e29 100644
- --- a/src/kdc/kdc_authdata.c
+++ b/src/kdc/kdc_authdata.c
@@ -495,7 +495,7 @@ merge_authdata (krb5_context context,
                 krb5_boolean copy,
                 krb5_boolean ignore_kdc_issued)
- -    size_t i, nadata = 0;
+    size_t i, j, nadata = 0;
     krb5_authdata **authdata = *out_authdata;
     if (in_authdata == NULL || in_authdata[0] == NULL)
@@ -529,16 +529,16 @@ merge_authdata (krb5_context context,
         in_authdata = tmp;
- -    for (i = 0; in_authdata[i] != NULL; i++) {
+    for (i = 0, j = 0; in_authdata[i] != NULL; i++) {
         if (ignore_kdc_issued &&
             is_kdc_issued_authdatum(context, in_authdata[i], 0)) {
         } else
- -            authdata[nadata + i] = in_authdata[i];
+            authdata[nadata + j++] = in_authdata[i];
- -    authdata[nadata + i] = NULL;
+    authdata[nadata + j] = NULL;

  This patch is also available at

  A PGP-signed patch is available at


This announcement is posted at:

This announcement and related security advisories may be found on the
MIT Kerberos security advisory page at:

The main MIT Kerberos web page is at:


CVE: CVE-2010-1322


Thanks to Mike Roszkowski for reporting this vulnerability, providing
a patch, and helping with analysis.  Thanks to Pavel Jindra and
Radoslav Bodo for additional testing.


The MIT Kerberos Team security contact address is
<krbcore-security at>.  When sending sensitive information,
please PGP-encrypt it using the following key:

pub   2048R/8B8DF501 2010-01-15 [expires: 2011-02-01]
uid     MIT Kerberos Team Security Contact <krbcore-security at>


In the function merge_authdata() in kdc_authdata.c, a loop that
attempts to exclude KDC-issued authorization data items when merging
two authorization data lists will advance the destination index
inappropriately when filtering out such an item.  As a result, that
entry in the destination list will be an uninitialized pointer.

Subsequent operations on the resulting authorization data list can
dereference that uninitialized pointer, typically causing a crash.  It
is theoretically possible that an attacker could manipulate the
contents of the heap so that the uninitialized pointer points to a
valid address, allowing unauthorized information disclosure,
manipulation of the authorization data in the resulting ticket, or a
subsequent free of that pointer.  It is theoretically possible that an
attacker inducing the freeing of a chosen pointer could corrupt the
heap and execute arbitrary code.

Windows Active Directory clients can produce TGS requests that trigger
this vulnerability fairly consistently.


2010-10-05      original release

Copyright (C) 2010 Massachusetts Institute of Technology
Version: GnuPG v1.4.8 (SunOS)

kerberos-announce mailing list
kerberos-announce at

More information about the krbdev mailing list