Executive Summary
Summary | |
---|---|
Title | pam_krb5 security and bug fix update |
Informations | |||
---|---|---|---|
Name | RHSA-2010:0258 | First vendor Publication | 2010-03-30 |
Vendor | RedHat | Last vendor Modification | 2010-03-30 |
Severity (Vendor) | Low | Revision | 04 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
---|---|---|---|
Cvss Base Score | 5 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated pam_krb5 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 3. Description: The pam_krb5 module allows Pluggable Authentication Modules (PAM) aware applications to use Kerberos to verify user identities by obtaining user credentials at log in time. A flaw was found in pam_krb5. In some non-default configurations (specifically, those where pam_krb5 would be the first module to prompt for a password), the text of the password prompt varied based on whether or not the username provided was a username known to the system. A remote attacker could use this flaw to recognize valid usernames, which would aid a dictionary-based password guess attack. (CVE-2009-1384) This update also fixes the following bugs: * certain applications which do not properly implement PAM conversations may fail to authenticate users whose passwords have expired and must be changed, or may succeed without forcing the user's password to be changed. This bug is triggered by a previously-applied fix to pam_krb5 which makes it comply more closely to PAM specifications. If an application misbehaves, enabling the "chpw_prompt" option for its service should restore the old behavior. (BZ#509092) * pam_krb5 does not allow the user to change an expired password in cases where the Key Distribution Center (KDC) is configured to refuse attempts to obtain forwardable password-changing credentials. This update fixes this issue. (BZ#489015) * failure to verify TGT because of wrong keytab handling. (BZ#450776) Users of pam_krb5 are advised to upgrade to these updated packages, which resolve these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at http://kbase.redhat.com/faq/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 450776 - Failed to verify TGT cause of wrong keytab handling 489015 - pam_krb5 cannot offer to change expired password 502602 - CVE-2009-1384 pam_krb5: Password prompt varies for existent and non-existent users 505265 - CVE-2009-1384 RHEL-5's pam_krb5: Password prompt varies for existent and non-existent users 509092 - pam_krb5 update breaks graphical apps (gnome and kde) |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2010-0258.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-287 | Improper Authentication |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:19879 | |||
Oval ID: | oval:org.mitre.oval:def:19879 | ||
Title: | Third party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX | ||
Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-1384 | Version: | 4 |
Platform(s): | VMWare ESX Server 4.1 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:21237 | |||
Oval ID: | oval:org.mitre.oval:def:21237 | ||
Title: | RHSA-2010:0258: pam_krb5 security and bug fix update (Low) | ||
Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2010:0258-04 CVE-2009-1384 | Version: | 4 |
Platform(s): | Red Hat Enterprise Linux 5 | Product(s): | pam_krb5 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:23055 | |||
Oval ID: | oval:org.mitre.oval:def:23055 | ||
Title: | ELSA-2010:0258: pam_krb5 security and bug fix update (Low) | ||
Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010:0258-04 CVE-2009-1384 | Version: | 6 |
Platform(s): | Oracle Linux 5 | Product(s): | pam_krb5 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27558 | |||
Oval ID: | oval:org.mitre.oval:def:27558 | ||
Title: | DEPRECATED: ELSA-2010-0258 -- pam_krb5 security and bug fix update (low) | ||
Description: | [2.2.14-15] - update backport for selecting which key to use for validation so that it prefers services with the local host name as the instance, from HEAD (more of #450776) [2.2.14-14] - backport the 'multiple_ccaches' option from HEAD, requiring that it be enabled to not immediately remove an old ccache when asked to create a new one (#463417) [2.2.14-13] - add patch to add the 'chpw_prompt' option, to allow the older behavior of attempting a password-change during authentication if libkrb5 detects an expired password, based on patch from Olivier Fourdan (#509092) [2.2.14-12] - dont vary the password prompt depending on whether or not the user exists or is known to the KDC (CVE-2009-1384, #505265) - prefer using the 'host' service when verifying that a TGT isnt forged, from HEAD (#450776) [2.2.14-11] - dont enforce minimum_uid when no_user_check is also used, from HEAD (#490404) - dont try to get password-changing creds with all of the flags set that we would request for a TGT (#489015) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2010-0258 CVE-2009-1384 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | pam_krb5 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:7081 | |||
Oval ID: | oval:org.mitre.oval:def:7081 | ||
Title: | pam_krb5 Existing/Non-Existing Username Enumeration Weakness | ||
Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-1384 | Version: | 5 |
Platform(s): | VMWare ESX Server 4.0 | Product(s): | |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:9652 | |||
Oval ID: | oval:org.mitre.oval:def:9652 | ||
Title: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
Description: | pam_krb5 2.2.14 through 2.3.4, as used in Red Hat Enterprise Linux (RHEL) 5, generates different password prompts depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2009-1384 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 3 |
OpenVAS Exploits
Date | Description |
---|---|
2012-04-16 | Name : VMSA-2010-0009: ESXi utilities and ESX Service Console third party updates File : nvt/gb_VMSA-2010-0009.nasl |
2012-03-16 | Name : VMSA-2011-0003.2 Third party component updates for VMware vCenter Server, vCe... File : nvt/gb_VMSA-2011-0003.nasl |
2010-04-06 | Name : RedHat Update for pam_krb5 RHSA-2010:0258-04 File : nvt/gb_RHSA-2010_0258-04_pam_krb5.nasl |
2010-03-12 | Name : Mandriva Update for pam_krb5 MDVSA-2010:054 (pam_krb5) File : nvt/gb_mandriva_MDVSA_2010_054.nasl |
2010-02-15 | Name : Mandriva Update for cacti MDVA-2010:054 (cacti) File : nvt/gb_mandriva_MDVA_2010_054.nasl |
2009-06-30 | Name : Fedora Core 11 FEDORA-2009-5983 (pam_krb5) File : nvt/fcore_2009_5983.nasl |
2009-06-30 | Name : Fedora Core 10 FEDORA-2009-6255 (pam_krb5) File : nvt/fcore_2009_6255.nasl |
2009-06-30 | Name : Fedora Core 9 FEDORA-2009-6279 (pam_krb5) File : nvt/fcore_2009_6279.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
54791 | pam_krb5 Login Prompt Remote Username Enumeration |
Information Assurance Vulnerability Management (IAVM)
Date | Description |
---|---|
2011-05-12 | IAVM : 2011-A-0066 - Multiple Vulnerabilities in VMware Products Severity : Category I - VMSKEY : V0027158 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2016-03-08 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2010-0009_remote.nasl - Type : ACT_GATHER_INFO |
2016-03-04 | Name : The remote VMware ESX / ESXi host is missing a security-related patch. File : vmware_VMSA-2011-0003_remote.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20100330_pam_krb5_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2011-02-14 | Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2011-0003.nasl - Type : ACT_GATHER_INFO |
2010-06-01 | Name : The remote VMware ESXi / ESX host is missing one or more security-related pat... File : vmware_VMSA-2010-0009.nasl - Type : ACT_GATHER_INFO |
2010-05-11 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0258.nasl - Type : ACT_GATHER_INFO |
2010-03-05 | Name : The remote Mandriva Linux host is missing a security update. File : mandriva_MDVSA-2010-054.nasl - Type : ACT_GATHER_INFO |
2009-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2009-5983.nasl - Type : ACT_GATHER_INFO |
2009-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2009-6255.nasl - Type : ACT_GATHER_INFO |
2009-06-28 | Name : The remote Fedora host is missing a security update. File : fedora_2009-6279.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:53:24 |
|