Executive Summary
Summary | |
---|---|
Title | krb5 security update |
Informations | |||
---|---|---|---|
Name | RHSA-2011:1379 | First vendor Publication | 2011-10-18 |
Vendor | RedHat | Last vendor Modification | 2011-10-18 |
Severity (Vendor) | Moderate | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C) | |||
---|---|---|---|
Cvss Base Score | 7.8 | Attack Range | Network |
Cvss Impact Score | 6.9 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 3. Description: Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC). Multiple NULL pointer dereference and assertion failure flaws were found in the MIT Kerberos KDC when it was configured to use an LDAP (Lightweight Directory Access Protocol) or Berkeley Database (Berkeley DB) back end. A remote attacker could use these flaws to crash the KDC. (CVE-2011-1527, CVE-2011-1528, CVE-2011-1529) Red Hat would like to thank the MIT Kerberos project for reporting the CVE-2011-1527 issue. Upstream acknowledges Andrej Ota as the original reporter of CVE-2011-1527. All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 737711 - CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 krb5: KDC denial of service vulnerabilities (MITKRB5-SA-2011-006) |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2011-1379.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-20 | Improper Input Validation |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:14768 | |||
Oval ID: | oval:org.mitre.oval:def:14768 | ||
Title: | DSA-2379-1 krb5 -- several | ||
Description: | It was discovered that the Key Distribution Center in Kerberos 5 crashes when processing certain crafted requests: CVE-2011-1528 When the LDAP backend is used, remote users can trigger a KDC daemon crash and denial of service. CVE-2011-1529 When the LDAP or Berkeley DB backend is used, remote users can trigger a NULL pointer dereference in the KDC daemon and a denial of service. The oldstable distribution is not affected by these problems. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2379-1 CVE-2011-1528 CVE-2011-1529 | Version: | 5 |
Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | krb5 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:21260 | |||
Oval ID: | oval:org.mitre.oval:def:21260 | ||
Title: | USN-1233-1 -- krb5 vulnerabilities | ||
Description: | Several denial of service issues were fixed in the Kerberos Key Distribution Center (KDC). | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1233-1 CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 | Version: | 5 |
Platform(s): | Ubuntu 11.10 Ubuntu 11.04 Ubuntu 10.10 Ubuntu 10.04 | Product(s): | krb5 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22017 | |||
Oval ID: | oval:org.mitre.oval:def:22017 | ||
Title: | RHSA-2011:1379: krb5 security update (Moderate) | ||
Description: | The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2011:1379-01 CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 | Version: | 42 |
Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | krb5 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:23734 | |||
Oval ID: | oval:org.mitre.oval:def:23734 | ||
Title: | ELSA-2011:1379: krb5 security update (Moderate) | ||
Description: | The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011:1379-01 CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 | Version: | 17 |
Platform(s): | Oracle Linux 6 | Product(s): | krb5 |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:27989 | |||
Oval ID: | oval:org.mitre.oval:def:27989 | ||
Title: | DEPRECATED: ELSA-2011-1379 -- krb5 security update (moderate) | ||
Description: | [1.9-9.2] - apply upstream patch to fix a null pointer derference with the LDAP kdb backend (CVE-2011-1527), an assertion failure with multiple kdb backends (CVE-2011-1528), and a null pointer dereference with multiple kdb backends (CVE-2011-1529) (#740084) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2011-1379 CVE-2011-1527 CVE-2011-1528 CVE-2011-1529 | Version: | 4 |
Platform(s): | Oracle Linux 6 | Product(s): | krb5 |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-07-09 | Name : RedHat Update for krb5 RHSA-2011:1379-01 File : nvt/gb_RHSA-2011_1379-01_krb5.nasl |
2012-06-15 | Name : Fedora Update for krb5 FEDORA-2012-8805 File : nvt/gb_fedora_2012_8805_krb5_fc15.nasl |
2012-02-12 | Name : Gentoo Security Advisory GLSA 201201-13 (mit-krb5) File : nvt/glsa_201201_13.nasl |
2012-02-11 | Name : Debian Security Advisory DSA 2379-1 (krb5) File : nvt/deb_2379_1.nasl |
2012-02-01 | Name : Fedora Update for krb5 FEDORA-2011-16284 File : nvt/gb_fedora_2011_16284_krb5_fc15.nasl |
2011-11-18 | Name : Fedora Update for krb5 FEDORA-2011-14650 File : nvt/gb_fedora_2011_14650_krb5_fc14.nasl |
2011-11-18 | Name : Fedora Update for krb5 FEDORA-2011-14673 File : nvt/gb_fedora_2011_14673_krb5_fc15.nasl |
2011-10-31 | Name : Mandriva Update for krb5 MDVSA-2011:160 (krb5) File : nvt/gb_mandriva_MDVSA_2011_160.nasl |
2011-10-21 | Name : Ubuntu Update for krb5 USN-1233-1 File : nvt/gb_ubuntu_USN_1233_1.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
76661 | Kerberos KDC lookup_lockout_policy() Function NULL Pointer Dereference Remote... |
76660 | Kerberos KDC krb5_ldap_get_principal() Function NULL Pointer Dereference Remo... |
76659 | Kerberos KDC Multiple Function Assertation Weakness Remote DoS |
Snort® IPS/IDS
Date | Description |
---|---|
2014-01-10 | MIT Kerberos kdb_ldap plugin kinit operation denial of service attempt RuleID : 26575 - Revision : 3 - Type : SERVER-OTHER |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_kerberos_20130702.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_krb5-111019.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_krb5-111019.nasl - Type : ACT_GATHER_INFO |
2013-09-04 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2011-15.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-1379.nasl - Type : ACT_GATHER_INFO |
2012-09-06 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-159.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20111018_krb5_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2012-01-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201201-13.nasl - Type : ACT_GATHER_INFO |
2012-01-12 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2379.nasl - Type : ACT_GATHER_INFO |
2011-11-16 | Name : The remote Fedora host is missing a security update. File : fedora_2011-14650.nasl - Type : ACT_GATHER_INFO |
2011-11-16 | Name : The remote Fedora host is missing a security update. File : fedora_2011-14673.nasl - Type : ACT_GATHER_INFO |
2011-10-24 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2011-160.nasl - Type : ACT_GATHER_INFO |
2011-10-19 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-1379.nasl - Type : ACT_GATHER_INFO |
2011-10-19 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1233-1.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:55:12 |
|