A vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of MIT Kerberos. Authentication is not required to exploit this vulnerability.
The specific flaw exists in the svcauth_gss_validate() function. By sending a large authentication context over RPC, a stack based buffer overflow occurs, resulting in a situation allowing for remote code execution.
The vulnerable line of the function is:
memcpy((caddr_t)buf, oa->oa_base, oa->oa_length);
If 128 < oa->oa_length < 400, the exploitable situation occurs. Over 400 bytes is caught during a separate check for MAX_AUTH_SIZE earlier in the RPC packet decoding process.
Disclosure Timeline:
2007.07.20 - Vulnerability reported to vendor
2007.09.07 - Digital Vaccine released to TippingPoint customers
2007.09.07 - Coordinated public release of advisory
