A stack overflow vulnerability in the RPCSEC_GSS (see rpcsec_gss(3NSL)) security flavor used to access the Generic Security Services Application Programming Interface (GSS-API) affects the Kerberos administration daemon (kadmind(1M)). This vulnerability may allow an unauthorized remote user the ability to execute arbitrary commands on Kerberos Key Distribution Center(KDC) systems with the privileges of the kadmind(1M) daemon (usually root). This may also allow the remote user to compromise the Kerberos key database or cause the kadmind(1M) daemon to crash, which is a type of Denial of Service (DoS).

Note: Third-party applications which utilize RPCSEC_GSS may also be affected.

This issue is also referenced in the following documents:

MITKRB5-SA-2007-006 at:

• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2007-006.txt

CVE-2007-3999 at:

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999

Note: Solaris is not affected by CVE-2007-4000 mentioned in MITKRB5-SA-2007-006.

This issue can occur in the following releases:

SPARC Platform

• Solaris 8 without patch 126928-02
• Solaris 9 without patch 113318-32
• Solaris 10 without patch 126661-02

x86 Platform

• Solaris 8 without patch 126929-02
• Solaris 9 without patch 117468-18
• Solaris 10 without patch 126662-02

Note: This issue only occurs if the system is configured as a Key Distribution Center (KDC).

To determine if the system is configured as a Key Distribution Center, the following command can be used:

    % pgrep -l kadmind
    938 kadmind

If the above command shows a process id, the daemon kadmind(1M) is running and the machine is configured as the Key Distribution Center (KDC).

There are no predictable symptoms that would indicate the described vulnerability has been exploited.

There is no workaround.  Please see the Resolution section below.

This issue is addressed in the following releases:

SPARC Platform

• Solaris 8 with patch 126928-02 or later
• Solaris 9 with patch 113318-32 or later
• Solaris 10 with patch 126661-02 or later

x86 Platform

• Solaris 8 with patch 126929-02 or later
• Solaris 9 with patch 117468-18 or later
• Solaris 10 with patch 126662-02 or later

• Updated Relief/Workaround section

• Updated Contributing Factors, Relief/Workaround, and Resolution sections

• State: Resolved
• Updated Contributing Factors and Resolution sections

This solution has no attachment