Vulnerability: schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly validate UDP packets before sending responses, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by krb_pingpong.nasl, a related issue to CVE-1999-0103.
Vulnerability ID: CVE-2002-2443
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/krb5/krb5
Published: 2013-05-29
File: src/kadmin/server/schpw.c
Commit message: Fix kpasswd UDP ping-pong [CVE-2002-2443]

The kpasswd service provided by kadmind was vulnerable to a UDP
"ping-pong" attack [CVE-2002-2443].  Don't respond to packets unless
they pass some basic validation, and don't respond to our own error
packets.

Some authors use CVE-1999-0103 to refer to the kpasswd UDP ping-pong
attack or UDP ping-pong attacks in general, but there is discussion
leading toward narrowing the definition of CVE-1999-0103 to the echo,
chargen, or other similar built-in inetd services.

Thanks to Vincent Danen for alerting us to this issue.

CVSSv2: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:P/RL:O/RC:C

ticket: 7637 (new)
target_version: 1.11.3
tags: pullup
Commit author: Tom Yu

Vulnerable version (before fix):
 process_chpw_request(krb5_context context, void *server_handle, char *realm,         ret = KRB5KRB_AP_ERR_MODIFIED;         numresult = KRB5_KPASSWD_MALFORMED;         strlcpy(strresult, "Request was truncated", sizeof(strresult));         goto chpwfail;     }      ptr = req->data; process_chpw_request(krb5_context context, void *server_handle, char *realm,         numresult = KRB5_KPASSWD_MALFORMED;         strlcpy(strresult, "Request length was inconsistent",                 sizeof(strresult));         goto chpwfail;     }      /* verify version number */ process_chpw_request(krb5_context context, void *server_handle, char *realm,         numresult = KRB5_KPASSWD_BAD_VERSION;         snprintf(strresult, sizeof(strresult),                  "Request contained unknown protocol version number %d", vno);         goto chpwfail;     }      /* read, check ap-req length */ process_chpw_request(krb5_context context, void *server_handle, char *realm,         numresult = KRB5_KPASSWD_MALFORMED;         strlcpy(strresult, "Request was truncated in AP-REQ",                 sizeof(strresult));         goto chpwfail;     }      /* verify ap_req */

Fixed version (after fix):
 process_chpw_request(krb5_context context, void *server_handle, char *realm,         ret = KRB5KRB_AP_ERR_MODIFIED;         numresult = KRB5_KPASSWD_MALFORMED;         strlcpy(strresult, "Request was truncated", sizeof(strresult));         goto bailout;     }      ptr = req->data; process_chpw_request(krb5_context context, void *server_handle, char *realm,         numresult = KRB5_KPASSWD_MALFORMED;         strlcpy(strresult, "Request length was inconsistent",                 sizeof(strresult));         goto bailout;     }      /* verify version number */ process_chpw_request(krb5_context context, void *server_handle, char *realm,         numresult = KRB5_KPASSWD_BAD_VERSION;         snprintf(strresult, sizeof(strresult),                  "Request contained unknown protocol version number %d", vno);         goto bailout;     }      /* read, check ap-req length */ process_chpw_request(krb5_context context, void *server_handle, char *realm,         numresult = KRB5_KPASSWD_MALFORMED;         strlcpy(strresult, "Request was truncated in AP-REQ",                 sizeof(strresult));         goto bailout;     }      /* verify ap_req */

Patch:
patch: @@ -52,7 +52,7 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
         ret = KRB5KRB_AP_ERR_MODIFIED;
         numresult = KRB5_KPASSWD_MALFORMED;
         strlcpy(strresult, "Request was truncated", sizeof(strresult));
-        goto chpwfail;
+        goto bailout;
     }
 
     ptr = req->data;
@@ -67,7 +67,7 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
         numresult = KRB5_KPASSWD_MALFORMED;
         strlcpy(strresult, "Request length was inconsistent",
                 sizeof(strresult));
-        goto chpwfail;
+        goto bailout;
     }
 
     /* verify version number */
@@ -80,7 +80,7 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
         numresult = KRB5_KPASSWD_BAD_VERSION;
         snprintf(strresult, sizeof(strresult),
                  "Request contained unknown protocol version number %d", vno);
-        goto chpwfail;
+        goto bailout;
     }
 
     /* read, check ap-req length */
@@ -93,7 +93,7 @@ process_chpw_request(krb5_context context, void *server_handle, char *realm,
         numresult = KRB5_KPASSWD_MALFORMED;
         strlcpy(strresult, "Request was truncated in AP-REQ",
                 sizeof(strresult));
-        goto chpwfail;
+        goto bailout;
     }
 
     /* verify ap_req */
path: src/kadmin/server/schpw.c