Executive Summary
| Summary | |
|---|---|
| Title | Kerberos vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-2498-1 | First vendor Publication | 2015-02-10 |
| Vendor | Ubuntu | Last vendor Modification | 2015-02-10 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.10 - Ubuntu 14.04 LTS - Ubuntu 12.04 LTS - Ubuntu 10.04 LTS Summary: Several security issues were fixed in Kerberos. Software Description: - krb5: MIT Kerberos Network Authentication Protocol Details: It was discovered that Kerberos incorrectly sent old keys in response to a -randkey -keepold request. An authenticated remote attacker could use this issue to forge tickets by leveraging administrative access. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-5351) It was discovered that the libgssapi_krb5 library incorrectly processed security context handles. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2014-5352) Patrik Kis discovered that Kerberos incorrectly handled LDAP queries with no results. An authenticated remote attacker could use this issue to cause the KDC to crash, resulting in a denial of service. (CVE-2014-5353) It was discovered that Kerberos incorrectly handled creating database entries for a keyless principal when using LDAP. An authenticated remote attacker could use this issue to cause the KDC to crash, resulting in a denial of service. (CVE-2014-5354) It was discovered that Kerberos incorrectly handled memory when processing XDR data. A remote attacker could use this issue to cause kadmind to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-9421) It was discovered that Kerberos incorrectly handled two-component server principals. A remote attacker could use this issue to perform impersonation attacks. (CVE-2014-9422) It was discovered that the libgssrpc library leaked uninitialized bytes. A remote attacker could use this issue to possibly obtain sensitive information. (CVE-2014-9423) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.10: Ubuntu 14.04 LTS: Ubuntu 12.04 LTS: Ubuntu 10.04 LTS: In general, a standard system update will make all the necessary changes. References: Package Information: |
Original Source
| Url : http://www.ubuntu.com/usn/USN-2498-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 25 % | CWE-476 | NULL Pointer Dereference |
| 25 % | CWE-284 | Access Control (Authorization) Issues |
| 25 % | CWE-255 | Credentials Management |
| 25 % | CWE-200 | Information Exposure |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:27784 | |||
| Oval ID: | oval:org.mitre.oval:def:27784 | ||
| Title: | SUSE-SU-2014:1410-1 -- Security update for krb5 (low) | ||
| Description: | This update for krb5 fixes the following issues: * When randomizing the keys for a service principal, current keys could be returned. (CVE-2014-5351) * klist -s crashes when handling multiple referral entries. (bnc#890623) Security Issues: * CVE-2014-5351 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5351> | ||
| Family: | unix | Class: | patch |
| Reference(s): | SUSE-SU-2014:1410-1 CVE-2014-5351 | Version: | 3 |
| Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | krb5 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28128 | |||
| Oval ID: | oval:org.mitre.oval:def:28128 | ||
| Title: | Return only new keys in randkey | ||
| Description: | The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2014-5351 | Version: | 4 |
| Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28572 | |||
| Oval ID: | oval:org.mitre.oval:def:28572 | ||
| Title: | AIX NAS Denial of Service via malformed XDR data | ||
| Description: | The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2014-9421 | Version: | 4 |
| Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:28597 | |||
| Oval ID: | oval:org.mitre.oval:def:28597 | ||
| Title: | AIX NAS allows remote users to obtain administrative access by leveraging access to a two-component principal | ||
| Description: | The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2014-9422 | Version: | 4 |
| Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:29035 | |||
| Oval ID: | oval:org.mitre.oval:def:29035 | ||
| Title: | AIX NAS denial of service vulnerability | ||
| Description: | The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2014-5352 | Version: | 4 |
| Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:29181 | |||
| Oval ID: | oval:org.mitre.oval:def:29181 | ||
| Title: | AIX NAS allows remote users to obtain sensitive information from process heap memory | ||
| Description: | The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits uninitialized interposer data to clients, which allows remote attackers to obtain sensitive information from process heap memory by sniffing the network for data in a handle field. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2014-9423 | Version: | 4 |
| Platform(s): | IBM AIX 6.1 IBM AIX 7.1 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2018-02-01 | Name : The remote Debian host is missing a security update. File : debian_DLA-1265.nasl - Type : ACT_GATHER_INFO |
| 2016-03-24 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2016-0039.nasl - Type : ACT_GATHER_INFO |
| 2015-07-24 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-1282-1.nasl - Type : ACT_GATHER_INFO |
| 2015-07-22 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-1276-1.nasl - Type : ACT_GATHER_INFO |
| 2015-06-22 | Name : The remote Fedora host is missing a security update. File : fedora_2015-7878.nasl - Type : ACT_GATHER_INFO |
| 2015-05-28 | Name : The remote AIX host has a version of NAS installed that is affected by multip... File : aix_nas_advisory3.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-0290-2.nasl - Type : ACT_GATHER_INFO |
| 2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2015-0290-1.nasl - Type : ACT_GATHER_INFO |
| 2015-05-07 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2015-518.nasl - Type : ACT_GATHER_INFO |
| 2015-04-23 | Name : The remote Fedora host is missing a security update. File : fedora_2015-5949.nasl - Type : ACT_GATHER_INFO |
| 2015-04-10 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150409_krb5_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2015-04-10 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2015-0054.nasl - Type : ACT_GATHER_INFO |
| 2015-04-10 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0794.nasl - Type : ACT_GATHER_INFO |
| 2015-04-10 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0794.nasl - Type : ACT_GATHER_INFO |
| 2015-04-09 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0794.nasl - Type : ACT_GATHER_INFO |
| 2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-069.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20150305_krb5_on_SL7_x.nasl - Type : ACT_GATHER_INFO |
| 2015-03-26 | Name : The remote Debian host is missing a security update. File : debian_DLA-146.nasl - Type : ACT_GATHER_INFO |
| 2015-03-20 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-246.nasl - Type : ACT_GATHER_INFO |
| 2015-03-18 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-0439.nasl - Type : ACT_GATHER_INFO |
| 2015-03-13 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-0439.nasl - Type : ACT_GATHER_INFO |
| 2015-03-13 | Name : The remote Fedora host is missing a security update. File : fedora_2015-2347.nasl - Type : ACT_GATHER_INFO |
| 2015-03-10 | Name : The remote Fedora host is missing a security update. File : fedora_2015-2382.nasl - Type : ACT_GATHER_INFO |
| 2015-03-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-0439.nasl - Type : ACT_GATHER_INFO |
| 2015-02-26 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_dbf9e66cbd5011e4a7ba206a8a720317.nasl - Type : ACT_GATHER_INFO |
| 2015-02-23 | Name : The remote FreeBSD host is missing a security-related update. File : freebsd_pkg_63527d0db9de11e48a48206a8a720317.nasl - Type : ACT_GATHER_INFO |
| 2015-02-13 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_3a888a1eb32111e483b2206a8a720317.nasl - Type : ACT_GATHER_INFO |
| 2015-02-12 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_krb5-20150206-150206.nasl - Type : ACT_GATHER_INFO |
| 2015-02-12 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-128.nasl - Type : ACT_GATHER_INFO |
| 2015-02-11 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2498-1.nasl - Type : ACT_GATHER_INFO |
| 2015-02-05 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_24ce5597acab11e4a847206a8a720317.nasl - Type : ACT_GATHER_INFO |
| 2015-02-04 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-3153.nasl - Type : ACT_GATHER_INFO |
| 2015-01-27 | Name : The remote AIX host has a version of NAS installed that is affected by an inf... File : aix_nas_advisory2.nasl - Type : ACT_GATHER_INFO |
| 2015-01-09 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-009.nasl - Type : ACT_GATHER_INFO |
| 2015-01-02 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-53.nasl - Type : ACT_GATHER_INFO |
| 2014-11-23 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-224.nasl - Type : ACT_GATHER_INFO |
| 2014-11-13 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_krb5-201410-141002.nasl - Type : ACT_GATHER_INFO |
| 2014-10-09 | Name : The remote Fedora host is missing a security update. File : fedora_2014-11940.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2015-02-19 21:27:41 |
|
| 2015-02-19 17:26:11 |
|
| 2015-02-12 13:24:04 |
|
| 2015-02-10 21:22:13 |
|
