-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-EN-14:08.heimdal Errata Notice The FreeBSD Project Topic: gss_pseudo_random interoperability issue Category: contrib Module: heimdal Announced: 2014-06-24 Credits: Marc Dionne, Nico Williams, and Benjamin Kaduk Affects: All supported versions of FreeBSD prior to 9.2-RELEASE. Corrected: 2013-12-16 06:52:30 UTC (stable/9, 9.2-STABLE) 2014-06-24 19:05:36 UTC (releng/9.2, 9.2-RELEASE-p9) 2014-06-24 19:05:36 UTC (releng/9.1, 9.1-RELEASE-p16) 2013-12-16 06:56:38 UTC (stable/8, 8.4-STABLE) 2014-06-24 19:05:47 UTC (releng/8.4, 8.4-RELEASE-p13) For general information regarding FreeBSD Errata Notices and Security Advisories, including descriptions of the fields above, security branches, and the following sections, please visit . I. Background Heimdal provides an implementation of Kerberos 5, the Generic Security Service API (GSS-API), and the krb5 GSS-API mechanism. The GSS-API is an abstract API that provides a unified interface for security services that wraps many underlying security mechanisms. Application protocols using the GSS-API exchange context tokens to establish a security context. Once the security context has successfully been established, it can be used to checksum and/or encrypt messages between the two parties of the context, securely generate an identical pseudorandom bitstring at both endpoints, and other security-related functionality. Kerberos 5 permits the use of different encryption types for encryption keys; part of the specification for each encryption type is a pseudo-random function that uses an encryption key and some optional seed data to produce a pseudo-random bitstring of a fixed length. The GSS_Pseudo_random function uses an established security context and some optional seed data to produce a pseudo-random bitstring of (nearly) arbitrary lengh. The specification for GSS_Pseudo_random for the krb5 mechanism (RFC 4402) uses a counter mode to produce the arbitrary length output from the fixed-length output of the underlying enctype's pseudo-random output. II. Problem Description RFC 4402 specifies that the counter which is prepended to the seed data must be encoded in network (big-endian) byte order before being input to the encryption type's pseudo-random function. All released versions of Heimdal that include a GSS_Pseudo_random implementation for the krb5 mechanism encode the counter as a little-endian integer. III. Impact Only applications using the GSS_Pseudo_random functionality with the krb5 mechanism are affected; the number of such applications is believed to be small. (RFC 4402 was published in 2006.) Since the first value used for the counter is zero, the first block of output is correct, but the second and all subsequent blocks of output are incorrect. Old versions of Heimdal will interoperate over the network with each other, but will not interoperate with MIT krb5 peers or other implementations of RFC 4402, if producing more than one block of pseudo-random output. For the commonly used AES encryption types, the first 128 bits of output are correct but the subsequent output differs. IV. Workaround Applications which do not use the GSS_Pseudo_random functionality are not affected. Applications which can reduce their pseudo-random needs to a single block length (e.g., 128 bits for AES) will interoperate with all known implementations. V. Solution Perform one of the following: 1) Upgrade your system to a supported FreeBSD stable or release / security branch (releng) dated after the correction date. 2) To update your present system via a source code patch: The following patches have been verified to apply to the applicable FreeBSD release branches. a) Download the relevant patch from the location below, and verify the detached PGP signature using your PGP utility. # fetch http://security.FreeBSD.org/patches/EN-14:08/heimdal.patch # fetch http://security.FreeBSD.org/patches/EN-14:08/heimdal.patch.asc # gpg --verify heimdal.patch.asc b) Apply the patch. Execute the following commands as root: # cd /usr/src # patch < /path/to/patch c) Recompile the operating system using buildworld and installworld as described in . Restart all deamons using the library, or reboot the system. 3) To update your system via a binary patch: Systems running a RELEASE version of FreeBSD on the i386 or amd64 platforms can be updated via the freebsd-update(8) utility: # freebsd-update fetch # freebsd-update install VI. Correction details The following list contains the revision numbers of each file that was corrected in FreeBSD. Branch/path Revision - ------------------------------------------------------------------------- stable/8/ r259452 releng/8.4/ r267832 stable/9/ r259451 releng/9.1/ r267831 releng/9.2/ r267831 stable/10/ r259447 releng/10.0/ r259758 - ------------------------------------------------------------------------- To see which files were modified by a particular revision, run the following command, replacing NNNNNN with the revision number, on a machine with Subversion installed: # svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base Or visit the following URL, replacing NNNNNN with the revision number: VII. References The discussion of this interoperability issue in the IETF kitten working group archives may be found here: http://www.ietf.org/mail-archive/web/kitten/current/msg04479.html The latest revision of this Errata Notice is available at http://security.FreeBSD.org/advisories/FreeBSD-EN-14:08.heimdal.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJTqc+KAAoJEO1n7NZdz2rnk2wP/RXxr1lgWeKY1wCusB/wlkLO 6cVsvZwIkvTvKNglkqY4dEvJJ1mdy25xP2yoft+ChM9ugTiGs5gfxsROXLCufobP 0ycnbl0pxL00aNwU3nXaejPhfblwwLmnwZAb3JuxF795BH/7z4a9vdC0mEn86RbQ efeu3hqxJJxDL65xUntlgzWiFSWB+DZUjBU9DAFWlOPnbVR2T3n5w4sFSWMDtmv+ AxqKjNVLgIHQKECTYjyFV2UjXCn6Np2m0dWHSpYM5MsdSaUolOqDRRxzAK5LKHg0 ieHTf1OgBpfe/iBuSwybtEv/4cagDvN82Vsni8MbLEeDMa4DSsKorea1SIrCTcBv CW4ugln7bBWgm3hnCEIWsy0wwhSVQetGFjYgimZySI5/nO2Jnh1Ung705MPCYpb7 +X+G/oLqp04Bq81sWY4KFN8cfcmM2fQyL0zYOS72VPjXEvwcHnsbjZ/yO8eekO+J oxkd8FaXR4b21HCh5cdlwWNNU4mu9wId8CLJW0y9l15zloTQvjW8+MSlEhAm9KUl nYq/qHGiLTvxmsHlnQumay8lhtRJf0r3pNih+xchxy7JCVeu84aZHSIDrklZoiAr LjOWagYFP9qHqhmmRxVoHKBeHgUaDWiJ9J0a0R44GadowrstYT7cYCzfSQr1KkDz HPlEHgAxXm0shG0bbEA5 =tTXE -----END PGP SIGNATURE-----