CVE-2002-2443: Improper Input Validation (CWE-20)
value: schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-05-29T14:29Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/kadmin/server/schpw.c
Commit date: 2013-05-13 12:46:34 -0400
Commit message: Fix kpasswd UDP ping-pong [CVE-2002-2443]

The kpasswd service provided by kadmind was vulnerable to a UDP
"ping-pong" attack [CVE-2002-2443].  Don't respond to packets unless
they pass some basic validation, and don't respond to our own error
packets.

Some authors use CVE-1999-0103 to refer to the kpasswd UDP ping-pong
attack or UDP ping-pong attacks in general, but there is discussion
leading toward narrowing the definition of CVE-1999-0103 to the echo,
chargen, or other similar built-in inetd services.

Thanks to Vincent Danen for alerting us to this issue.

CVSSv2: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C

ticket: 7637 (new)
target_version: 1.11.3
tags: pullup

Diff: diff --git a/src/kadmin/server/schpw.c b/src/kadmin/server/schpw.c
index 15b0ab5a3..7f455d864 100644
--- a/src/kadmin/server/schpw.c
+++ b/src/kadmin/server/schpw.c
@@ -50,11 +50,11 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
         /* either this, or the server is printing bad messages,
            or the caller passed in garbage */
         ret = KRB5KRB_AP_ERR_MODIFIED;
         numresult = KRB5_KPASSWD_MALFORMED;
         strlcpy(strresult, "Request was truncated", sizeof(strresult));
-        goto chpwfail;
+        goto bailout;
     }
 
     ptr = req->data;
 
     /* verify length */
@@ -65,11 +65,11 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
     if (plen != req->length) {
         ret = KRB5KRB_AP_ERR_MODIFIED;
         numresult = KRB5_KPASSWD_MALFORMED;
         strlcpy(strresult, "Request length was inconsistent",
                 sizeof(strresult));
-        goto chpwfail;
+        goto bailout;
     }
 
     /* verify version number */
 
     vno = (*ptr++ & 0xff) ;
@@ -78,11 +78,11 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
     if (vno != 1 && vno != RFC3244_VERSION) {
         ret = KRB5KDC_ERR_BAD_PVNO;
         numresult = KRB5_KPASSWD_BAD_VERSION;
         snprintf(strresult, sizeof(strresult),
                  "Request contained unknown protocol version number %d", vno);
-        goto chpwfail;
+        goto bailout;
     }
 
     /* read, check ap-req length */
 
     ap_req.length = (*ptr++ & 0xff);
@@ -91,11 +91,11 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
     if (ptr + ap_req.length >= req->data + req->length) {
         ret = KRB5KRB_AP_ERR_MODIFIED;
         numresult = KRB5_KPASSWD_MALFORMED;
         strlcpy(strresult, "Request was truncated in AP-REQ",
                 sizeof(strresult));
-        goto chpwfail;
+        goto bailout;
     }
 
     /* verify ap_req */
 
     ap_req.data = ptr;

Vulnerable code:         goto chpwfail;
        goto chpwfail;
        goto chpwfail;
        goto chpwfail;
Fixed code:         goto bailout;
        goto bailout;
        goto bailout;
        goto bailout;