Unspecified vulnerability in rshd in Heimdal 0.6.x before 0.6.6 and 0.7.x before 0.7.2, when storing forwarded credentials, allows attackers to overwrite arbitrary files and change file ownership via unknown vectors.

Two vulnerabilities have been discovered in heimdal, a free implementation of Kerberos 5. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities :

  - CVE-2006-0582     Privilege escalation in the rsh server allows an     authenticated attacker to overwrite arbitrary files and     gain ownership of them.

  - CVE-2006-0677     A remote attacker could force the telnet server to crash     before the user logged in, resulting in inetd turning     telnetd off because it forked too fast.

The old stable distribution (woody) does not expose rsh and telnet servers.

A Project heimdal Security Advisory reports :

The telnet client program in Heimdal has buffer overflows in the functions slc_add_reply() and env_opt_add(), which may lead to remote code execution.

The telnetd server program in Heimdal has buffer overflows in the function getterminaltype, which may lead to remote code execution.

The rshd server in Heimdal has a privilege escalation bug when storing forwarded credentials. The code allowes a user to overwrite a file with its credential cache, and get ownership of the file.

The remote host is affected by the vulnerability described in GLSA-200603-14 (Heimdal: rshd privilege escalation)

    An unspecified privilege escalation vulnerability in the rshd     server of Heimdal has been reported.
  Impact :

    Authenticated users could exploit the vulnerability to escalate     privileges or to change the ownership and content of arbitrary files.
  Workaround :

    There is no known workaround at this time.

A privilege escalation flaw has been found in the heimdal rsh (remote shell) server. This allowed an authenticated attacker to overwrite arbitrary files and gain ownership of them.

Please note that the heimdal-servers package is not officially supported in Ubuntu (it is in the 'universe' component of the archive). However, this affects you if you use a customized version built from the heimdal source package (which is supported).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
22843	Debian DSA-977-1 : heimdal - several vulnerabilities	Nessus	Debian Local Security Checks	high
21499	FreeBSD : heimdal -- Multiple vulnerabilities (b62c80c2-b81a-11da-bec5-00123ffe8333)	Nessus	FreeBSD Local Security Checks	high
21095	GLSA-200603-14 : Heimdal: rshd privilege escalation	Nessus	Gentoo Local Security Checks	low
21055	Ubuntu 4.10 / 5.04 / 5.10 : heimdal vulnerability (USN-247-1)	Nessus	Ubuntu Local Security Checks	low

Detections

Analytics

CVE-2006-0582

high

Tenable Plugins

high

high

low

low