Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Summary | |
|---|---|
| Title | krb5 vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-449-1 | First vendor Publication | 2007-04-04 |
| Vendor | Ubuntu | Last vendor Modification | 2007-04-04 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 9 | Attack Range | Network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 8 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 5.10 Ubuntu 6.06 LTS Ubuntu 6.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 5.10: Ubuntu 6.06 LTS: Ubuntu 6.10: In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: The krb5 telnet service did not appropriately verify user names. A remote attacker could log in as the root user by requesting a specially crafted user name. (CVE-2007-0956) The krb5 syslog library did not correctly verify the size of log messages. A remote attacker could send a specially crafted message and execute arbitrary code with root privileges. (CVE-2007-0957) The krb5 administration service was vulnerable to a double-free in the GSS RPC library. A remote attacker could send a specially crafted request and execute arbitrary code with root privileges. (CVE-2007-1216) |
Original Source
| Url : http://www.ubuntu.com/usn/USN-449-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 33 % | CWE-787 | Out-of-bounds Write (CWE/SANS Top 25) |
| 33 % | CWE-415 | Double Free |
| 33 % | CWE-306 | Missing Authentication for Critical Function (CWE/SANS Top 25) |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10046 | |||
| Oval ID: | oval:org.mitre.oval:def:10046 | ||
| Title: | The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882. | ||
| Description: | The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-0956 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:10757 | |||
| Oval ID: | oval:org.mitre.oval:def:10757 | ||
| Title: | Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers. | ||
| Description: | Stack-based buffer overflow in the krb5_klog_syslog function in the kadm5 library, as used by the Kerberos administration daemon (kadmind) and Key Distribution Center (KDC), in MIT krb5 before 1.6.1 allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via crafted arguments, possibly involving certain format string specifiers. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-0957 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:11135 | |||
| Oval ID: | oval:org.mitre.oval:def:11135 | ||
| Title: | Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding". | ||
| Description: | Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding". | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2007-1216 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:18864 | |||
| Oval ID: | oval:org.mitre.oval:def:18864 | ||
| Title: | DSA-1276-1 krb5 - several vulnerabilities | ||
| Description: | Several remote vulnerabilities have been discovered in the MIT reference implementation of the Kerberos network authentication protocol suite, which may lead to the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-1276-1 CVE-2007-0956 CVE-2007-0957 CVE-2007-1216 | Version: | 7 |
| Platform(s): | Debian GNU/Linux 4.0 | Product(s): | krb5 |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22677 | |||
| Oval ID: | oval:org.mitre.oval:def:22677 | ||
| Title: | ELSA-2007:0095: krb5 security update (Critical) | ||
| Description: | Double free vulnerability in the GSS-API library (lib/gssapi/krb5/k5unseal.c), as used by the Kerberos administration daemon (kadmind) in MIT krb5 before 1.6.1, when used with the authentication method provided by the RPCSEC_GSS RPC library, allows remote authenticated users to execute arbitrary code and modify the Kerberos key database via a message with an "an invalid direction encoding". | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2007:0095-01 CVE-2007-0956 CVE-2007-0957 CVE-2007-1216 | Version: | 17 |
| Platform(s): | Oracle Linux 5 | Product(s): | krb5 |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
| 2009-09-23 | Name : Solaris Update for kpasswd, libgss.so.1 and libkadm5clnt.so.1 109224-11 File : nvt/gb_solaris_109224_11.nasl |
| 2009-09-23 | Name : Solaris Update for kpasswd, libgss.so.1 and libkadm5clnt.so.1 109223-11 File : nvt/gb_solaris_109223_11.nasl |
| 2009-06-03 | Name : Solaris Update for Obsoleted by 109223-10 File : nvt/gb_solaris_109223_10.nasl |
| 2009-06-03 | Name : Solaris Update for krb5 krb5kdc 116045-02 File : nvt/gb_solaris_116045_02.nasl |
| 2009-06-03 | Name : Solaris Update for kadmind & kdb5_util 116044-04 File : nvt/gb_solaris_116044_04.nasl |
| 2009-06-03 | Name : Solaris Update for ktutil kdb5_util kadmin kadmin.local kadmind 112925-08 File : nvt/gb_solaris_112925_08.nasl |
| 2009-06-03 | Name : Solaris Update for krb5 usr/lib 112923-04 File : nvt/gb_solaris_112923_04.nasl |
| 2009-06-03 | Name : Solaris Update for libkadm5 112921-09 File : nvt/gb_solaris_112921_09.nasl |
| 2009-06-03 | Name : Solaris Update for libkadm5 116046-09 File : nvt/gb_solaris_116046_09.nasl |
| 2009-06-03 | Name : Solaris Update for Obsoleted by 109224-10 File : nvt/gb_solaris_109224_10.nasl |
| 2009-06-03 | Name : Solaris Update for libkadm5 library 116175-05 File : nvt/gb_solaris_116175_05.nasl |
| 2009-06-03 | Name : Solaris Update for kernel 120011-14 File : nvt/gb_solaris_120011_14.nasl |
| 2009-06-03 | Name : Solaris Update for kernel 120012-14 File : nvt/gb_solaris_120012_14.nasl |
| 2009-05-05 | Name : HP-UX Update for Kerberos HPSBUX02217 File : nvt/gb_hp_ux_HPSBUX02217.nasl |
| 2009-04-09 | Name : Mandriva Update for krb5 MDKSA-2007:077-1 (krb5) File : nvt/gb_mandriva_MDKSA_2007_077_1.nasl |
| 2009-04-09 | Name : Mandriva Update for krb5 MDKSA-2007:077 (krb5) File : nvt/gb_mandriva_MDKSA_2007_077.nasl |
| 2009-03-23 | Name : Ubuntu Update for krb5 vulnerabilities USN-449-1 File : nvt/gb_ubuntu_USN_449_1.nasl |
| 2009-02-27 | Name : Fedora Update for krb5 FEDORA-2007-0740 File : nvt/gb_fedora_2007_0740_krb5_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for krb5 FEDORA-2007-2066 File : nvt/gb_fedora_2007_2066_krb5_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for krb5 FEDORA-2007-2017 File : nvt/gb_fedora_2007_2017_krb5_fc7.nasl |
| 2009-02-27 | Name : Fedora Update for krb5 FEDORA-2007-620 File : nvt/gb_fedora_2007_620_krb5_fc5.nasl |
| 2009-02-27 | Name : Fedora Update for krb5 FEDORA-2007-409 File : nvt/gb_fedora_2007_409_krb5_fc5.nasl |
| 2009-02-27 | Name : Fedora Update for krb5 FEDORA-2007-408 File : nvt/gb_fedora_2007_408_krb5_fc6.nasl |
| 2009-02-16 | Name : Fedora Update for krb5 FEDORA-2008-2637 File : nvt/gb_fedora_2008_2637_krb5_fc7.nasl |
| 2009-01-28 | Name : SuSE Update for krb5 SUSE-SA:2007:025 File : nvt/gb_suse_2007_025.nasl |
| 2008-09-24 | Name : Gentoo Security Advisory GLSA 200704-02 (mit-krb5) File : nvt/glsa_200704_02.nasl |
| 2008-01-17 | Name : Debian Security Advisory DSA 1276-1 (krb5) File : nvt/deb_1276_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 34106 | MIT Kerberos telnet Crafted Username Remote Authentication Bypass |
| 34105 | MIT Kerberos 5 kadmind GSS-API Library Remote Key Database Manipulation |
| 34104 | MIT Kerberos 5 KDC krb5_klog_syslog() Function Remote Overflow |
Snort® IPS/IDS
| Date | Description |
|---|---|
| 2014-01-10 | MIT Kerberos V% KAdminD klog_vsyslog server overflow attempt RuleID : 16207 - Revision : 11 - Type : SERVER-WEBAPP |
| 2014-01-10 | kerberos login environment variable authentication bypass attempt RuleID : 10464 - Revision : 8 - Type : PROTOCOL-TELNET |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-0095.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_krb5-apps-servers-3022.nasl - Type : ACT_GATHER_INFO |
| 2007-12-13 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_krb5-3046.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-449-1.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_krb5-3045.nasl - Type : ACT_GATHER_INFO |
| 2007-10-17 | Name : The remote openSUSE host is missing a security update. File : suse_krb5-apps-servers-3021.nasl - Type : ACT_GATHER_INFO |
| 2007-09-25 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_36286.nasl - Type : ACT_GATHER_INFO |
| 2007-09-25 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_36361.nasl - Type : ACT_GATHER_INFO |
| 2007-09-25 | Name : The remote HP-UX host is missing a security-related patch. File : hpux_PHSS_34991.nasl - Type : ACT_GATHER_INFO |
| 2007-04-21 | Name : The remote host is missing a Mac OS X update that fixes a security issue. File : macosx_SecUpd2007-004.nasl - Type : ACT_GATHER_INFO |
| 2007-04-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-1276.nasl - Type : ACT_GATHER_INFO |
| 2007-04-05 | Name : It is possible to log into the remote host using telnet without supplying any... File : krb_telnet_env.nasl - Type : ACT_ATTACK |
| 2007-04-05 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-077.nasl - Type : ACT_GATHER_INFO |
| 2007-04-05 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-0095.nasl - Type : ACT_GATHER_INFO |
| 2007-04-05 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200704-02.nasl - Type : ACT_GATHER_INFO |
| 2007-04-05 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-0095.nasl - Type : ACT_GATHER_INFO |
| 2006-11-06 | Name : The remote host is missing Sun Security Patch number 116462-06 File : solaris9_116462.nasl - Type : ACT_GATHER_INFO |
| 2005-04-17 | Name : The remote host is missing Sun Security Patch number 109223-10 File : solaris8_109223.nasl - Type : ACT_GATHER_INFO |
| 2005-04-17 | Name : The remote host is missing Sun Security Patch number 109224-10 File : solaris8_x86_109224.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:04:18 |
|
