8.5 - HPSBUX02217 SSRT071337

Executive Summary

Summary
Title	HP-UX running Kerberos, Remote Arbitrary Code Execution

Informations
Name	HPSBUX02217 SSRT071337	First vendor Publication	2007-05-15
Vendor	HP	Last vendor Modification	2007-05-25
Severity (Vendor)	N/A	Revision	2

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:S/C:C/I:C/A:C)
Cvss Base Score	8.5	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	6.8	Authentication	Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

A potential security vulnerability has been identified on HP-UX running Kerberos. The vulnerability could be exploited by remote authorized users to execute arbitrary code.

Original Source

Url : http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01056923

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-415	Double Free

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11135

Oval ID:	oval:org.mitre.oval:def:11135
Title:	Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
Description:	Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-1216	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section krb5-workstation is earlier than 0:1.2.7-61 AND krb5 is earlier than 0:1.2.7-61 AND krb5-libs is earlier than 0:1.2.7-61 AND krb5-server is earlier than 0:1.2.7-61 AND krb5-devel is earlier than 0:1.2.7-61 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section krb5-workstation is earlier than 0:1.3.4-46 AND krb5 is earlier than 0:1.3.4-46 AND krb5-libs is earlier than 0:1.3.4-46 AND krb5-server is earlier than 0:1.3.4-46 AND krb5-devel is earlier than 0:1.3.4-46 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section krb5-workstation is earlier than 0:1.5-23 AND krb5 is earlier than 0:1.5-23 AND krb5-libs is earlier than 0:1.5-23 AND krb5-server is earlier than 0:1.5-23 AND krb5-devel is earlier than 0:1.5-23

Definition Id: oval:org.mitre.oval:def:18864

Oval ID:	oval:org.mitre.oval:def:18864
Title:	DSA-1276-1 krb5 - several vulnerabilities
Description:	Several remote vulnerabilities have been discovered in the MIT reference implementation of the Kerberos network authentication protocol suite, which may lead to the execution of arbitrary code.
Family:	unix	Class:	patch
Reference(s):	DSA-1276-1 CVE-2007-0956 CVE-2007-0957 CVE-2007-1216	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	krb5
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND krb5 DPKG is earlier than 1.4.4-7etch1

Definition Id: oval:org.mitre.oval:def:22677

Oval ID:	oval:org.mitre.oval:def:22677
Title:	ELSA-2007:0095: krb5 security update (Critical)
Description:	Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding".
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:0095-01 CVE-2007-0956 CVE-2007-0957 CVE-2007-1216	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	krb5
Definition Synopsis:
Oracle Linux 5.x rpm test krb5-libs is earlier than 0:1.5-23 AND krb5-devel is earlier than 0:1.5-23 AND krb5-server is earlier than 0:1.5-23 AND krb5 is earlier than 0:1.5-23 AND krb5-workstation is earlier than 0:1.5-23

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mit Kerberos 5 cpe:2.3:a:mit:kerberos_5:1.6:::::::* cpe:2.3:a:mit:kerberos_5:1.5.3:::::::* cpe:2.3:a:mit:kerberos_5:1.5.2:::::::* cpe:2.3:a:mit:kerberos_5:1.5.1:::::::* cpe:2.3:a:mit:kerberos_5:1.5:::::::* cpe:2.3:a:mit:kerberos_5:1.4.4:::::::* cpe:2.3:a:mit:kerberos_5:1.4.3:::::::* cpe:2.3:a:mit:kerberos_5:1.4.2:::::::* cpe:2.3:a:mit:kerberos_5:1.4.1:::::::* cpe:2.3:a:mit:kerberos_5:1.4:::::::* cpe:2.3:a:mit:kerberos_5:1.3.6:::::::* cpe:2.3:a:mit:kerberos_5:1.3.5:::::::* cpe:2.3:a:mit:kerberos_5:1.3.4:::::::* cpe:2.3:a:mit:kerberos_5:1.3.3:::::::* cpe:2.3:a:mit:kerberos_5:1.3.2:::::::* cpe:2.3:a:mit:kerberos_5:1.3.1:::::::* cpe:2.3:a:mit:kerberos_5:1.3:-:::::: cpe:2.3:a:mit:kerberos_5:1.3:alpha1:::::: cpe:2.3:a:mit:kerberos_5:1.2.8:::::::* cpe:2.3:a:mit:kerberos_5:1.2.7:::::::* cpe:2.3:a:mit:kerberos_5:1.2.6:::::::* cpe:2.3:a:mit:kerberos_5:1.2.5:::::::* cpe:2.3:a:mit:kerberos_5:1.2.4:::::::* cpe:2.3:a:mit:kerberos_5:1.2.3:::::::* cpe:2.3:a:mit:kerberos_5:1.2.2:::::::* cpe:2.3:a:mit:kerberos_5:1.2.1:::::::* cpe:2.3:a:mit:kerberos_5:1.2:beta1:::::: cpe:2.3:a:mit:kerberos_5:1.2:-:::::: cpe:2.3:a:mit:kerberos_5:1.2:beta2:::::: cpe:2.3:a:mit:kerberos_5:1.1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.1:::::::* cpe:2.3:a:mit:kerberos_5:1.0.6:::::::* cpe:2.3:a:mit:kerberos_5:1.0:-:::::: cpe:2.3:a:mit:kerberos_5:::::::: cpe:2.3:a:mit:kerberos_5:-:::::::*	35
Os	Canonical Ubuntu Linux cpe:2.3:o:canonical:ubuntu_linux:6.10:::::::* cpe:2.3:o:canonical:ubuntu_linux:6.06:::::::* cpe:2.3:o:canonical:ubuntu_linux:5.10:::::::*	3
Os	Debian Debian Linux cpe:2.3:o:debian:debian_linux:4.0:::::::* cpe:2.3:o:debian:debian_linux:3.1:::::::*	2

OpenVAS Exploits

Date	Description
2009-11-17	Name : Mac OS X Version File : nvt/macosx_version.nasl
2009-05-05	Name : HP-UX Update for Kerberos HPSBUX02217 File : nvt/gb_hp_ux_HPSBUX02217.nasl
2009-04-09	Name : Mandriva Update for krb5 MDKSA-2007:077 (krb5) File : nvt/gb_mandriva_MDKSA_2007_077.nasl
2009-04-09	Name : Mandriva Update for krb5 MDKSA-2007:077-1 (krb5) File : nvt/gb_mandriva_MDKSA_2007_077_1.nasl
2009-03-23	Name : Ubuntu Update for krb5 vulnerabilities USN-449-1 File : nvt/gb_ubuntu_USN_449_1.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-0740 File : nvt/gb_fedora_2007_0740_krb5_fc7.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-2017 File : nvt/gb_fedora_2007_2017_krb5_fc7.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-2066 File : nvt/gb_fedora_2007_2066_krb5_fc7.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-408 File : nvt/gb_fedora_2007_408_krb5_fc6.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-409 File : nvt/gb_fedora_2007_409_krb5_fc5.nasl
2009-02-27	Name : Fedora Update for krb5 FEDORA-2007-620 File : nvt/gb_fedora_2007_620_krb5_fc5.nasl
2009-02-16	Name : Fedora Update for krb5 FEDORA-2008-2637 File : nvt/gb_fedora_2008_2637_krb5_fc7.nasl
2009-01-28	Name : SuSE Update for krb5 SUSE-SA:2007:025 File : nvt/gb_suse_2007_025.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200704-02 (mit-krb5) File : nvt/glsa_200704_02.nasl
2008-01-17	Name : Debian Security Advisory DSA 1276-1 (krb5) File : nvt/deb_1276_1.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
34105	MIT Kerberos 5 kadmind GSS-API Library Remote Key Database Manipulation

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0095.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_krb5-3046.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-449-1.nasl - Type : ACT_GATHER_INFO
2007-10-17	Name : The remote openSUSE host is missing a security update. File : suse_krb5-3045.nasl - Type : ACT_GATHER_INFO
2007-09-25	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34991.nasl - Type : ACT_GATHER_INFO
2007-09-25	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_36286.nasl - Type : ACT_GATHER_INFO
2007-09-25	Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_36361.nasl - Type : ACT_GATHER_INFO
2007-04-21	Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd2007-004.nasl - Type : ACT_GATHER_INFO
2007-04-10	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1276.nasl - Type : ACT_GATHER_INFO
2007-04-05	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0095.nasl - Type : ACT_GATHER_INFO
2007-04-05	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200704-02.nasl - Type : ACT_GATHER_INFO
2007-04-05	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-077.nasl - Type : ACT_GATHER_INFO
2007-04-05	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0095.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:38:26	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	3
CPE ID(s)	40
osvdb(s)	1
Openvas Exploit(s)	15
Nessus® Exploit(s)	13

	Related
9	CVE-2007-1216
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

Copyright Security-Database 2006-2024 - Powered by themself ;) in 0.0480s

Facebook rss twitter linkedin mail