Executive Summary

Summary
Title New krb5 packages fix buffer overflows
Informations
Name DSA-520 First vendor Publication 2004-06-16
Vendor Debian Last vendor Modification 2004-06-16
Severity (Vendor) N/A Revision 1

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 10 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

In their advisory MITKRB5-SA-2004-001, the MIT Kerberos announced the existence of buffer overflow vulnerabilities in the krb5_aname_to_localname function. This function is only used if aname_to_localname is enabled in the configuration (this is not enabled by default).

For the current stable distribution (woody), this problem has been fixed in version 1.2.4-5woody5.

For the unstable distribution (sid), this problem has been fixed in version 1.3.3-2.

We recommend that you update your krb5 package.

Original Source

Url : http://www.debian.org/security/2004/dsa-520

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10295
 
Oval ID: oval:org.mitre.oval:def:10295
Title: Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Description: Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0523
 Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:2002
 
Oval ID: oval:org.mitre.oval:def:2002
Title: Multiple Buffer Overflows in Kerberos 5 (krb5_aname_to_localname)
Description: Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0523
 Version: 2
Platform(s): Sun Solaris 7
 Product(s): Solaris Enterprise Authentication Mechanism (SEAM)
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:724
 
Oval ID: oval:org.mitre.oval:def:724
Title: MIT Kerberos 5 KRB5_AName_To_Localname Multiple Principal Name Buffer Overrun Vulnerabilities
Description: Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0523
 Version: 4
Platform(s): Sun Solaris 9
Sun Solaris 8
Sun Solaris 7
 Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:991
 
Oval ID: oval:org.mitre.oval:def:991
Title: Multiple BO Vulnerabilities in MIT Kerberos 5
Description: Multiple buffer overflows in krb5_aname_to_localname for MIT Kerberos 5 (krb5) 1.3.3 and earlier allow remote attackers to execute arbitrary code as root.
Family: unix Class: vulnerability
Reference(s): CVE-2004-0523
 Version: 4
Platform(s): Red Hat Enterprise Linux 3
 Product(s): MIT Kerberos 5 (krb5)
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3
Application 17
Application 2
Application 3
Application 2
Os 3
Os 1

OpenVAS Exploits

Date Description
2008-09-24 Name : Gentoo Security Advisory GLSA 200406-21 (mit-krb5)
File : nvt/glsa_200406_21.nasl
2008-01-17 Name : Debian Security Advisory DSA 520-1 (krb5)
File : nvt/deb_520_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
6846 MIT Kerberos 5 krb5_aname_to_localname() Buffer Overflow

A remote overflow exists in Kerberos 5. Kerberos fails to check the string length in the functions aname_replacer(), do_replacement() and rule_an_to_ln() resulting in a heap buffer overflow. With a specially crafted request, an attacker can gain remote access as root resulting in a loss of confidentiality, integrity, and/or availability. This vulnerability only exists when the software is used with a non-standard configuration. Please see the MIT release notes for the details.

Nessus® Vulnerability Scanner

Date Description
2006-11-06 Name : The remote host is missing Sun Security Patch number 112536-06
File : solaris7_112536.nasl - Type : ACT_GATHER_INFO
2006-11-06 Name : The remote host is missing Sun Security Patch number 112537-06
File : solaris7_x86_112537.nasl - Type : ACT_GATHER_INFO
2004-09-29 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-520.nasl - Type : ACT_GATHER_INFO
2004-09-08 Name : The remote host is missing a Mac OS X update that fixes a security issue.
File : macosx_SecUpd20040907.nasl - Type : ACT_GATHER_INFO
2004-08-30 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200406-21.nasl - Type : ACT_GATHER_INFO
2004-07-31 Name : The remote Mandrake Linux host is missing one or more security updates.
File : mandrake_MDKSA-2004-056.nasl - Type : ACT_GATHER_INFO
2004-07-23 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-149.nasl - Type : ACT_GATHER_INFO
2004-07-23 Name : The remote Fedora Core host is missing a security update.
File : fedora_2004-150.nasl - Type : ACT_GATHER_INFO
2004-07-12 Name : The remote host is missing Sun Security Patch number 112908-38
File : solaris9_112908.nasl - Type : ACT_GATHER_INFO
2004-07-12 Name : The remote host is missing Sun Security Patch number 115168-24
File : solaris9_x86_115168.nasl - Type : ACT_GATHER_INFO
2004-07-06 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2004-236.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:33:21
  • Multiple Updates