The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.

Bugs in the handling of pointers to uninitializes resp. already freed memory could potentially be abused by attackers to execute code.
(CVE-2006-6144 / CVE-2006-6143)

The server-side portion of Kerberos' RPC library had a memory management flaw which allowed users of that library to call a function pointer located in unallocated memory. By doing specially crafted calls to the kadmind server, a remote attacker could exploit this to execute arbitrary code with root privileges on the target computer.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bugs in the handling of pointers to uninitializes resp. already freed memory could potentially be abused by attackers to execute code (CVE-2006-6144, CVE-2006-6143).

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2007-004 applied.

This update fixes security flaws in the following applications :

AFP Client AirPort CarbonCore diskdev_cmds fetchmail ftpd gnutar Help Viewer HID Family Installer Kerberos Libinfo Login Window network_cmds SMB System Configuration URLMount Video Conference WebDAV

A vulnerability in the RPC library in Kerberos 1.4.x and 1.5.x as used in the kadmind administration daemon calls an uninitialized function pointer in freed memory, which could allow a remote attacker to cause a Denial of Service and possibly execute arbitrary code via unspecified vectors.

Updated packages are patched to address this issue.

The remote host is affected by the vulnerability described in GLSA-200701-21 (MIT Kerberos 5: Arbitrary Remote Code Execution)

    The Kerberos administration daemon, and possibly other applications     using the GSS-API or RPC libraries, could potentially call a function     pointer in a freed heap buffer, or attempt to free an uninitialized     pointer.
  Impact :

    A remote attacker may be able to crash an affected application, or     potentially execute arbitrary code with root privileges.
  Workaround :

    There is no known workaround at this time.

This update incorporates a fix for a recently-announced bug found in the kadmind daemon.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update incorporates fixes for recently-announced bugs found in the kadmind daemon.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
29491	SuSE 10 Security Update : Kerberos5 (ZYPP Patch Number 2440)	Nessus	SuSE Local Security Checks	high
27996	Ubuntu 6.06 LTS / 6.10 : krb5 vulnerability (USN-408-1)	Nessus	Ubuntu Local Security Checks	high
27307	openSUSE 10 Security Update : krb5 (krb5-2442)	Nessus	SuSE Local Security Checks	high
25081	Mac OS X Multiple Vulnerabilities (Security Update 2007-004)	Nessus	MacOS X Local Security Checks	critical
24624	Mandrake Linux Security Advisory : krb5 (MDKSA-2007:008)	Nessus	Mandriva Local Security Checks	high
24257	GLSA-200701-21 : MIT Kerberos 5: Arbitrary Remote Code Execution	Nessus	Gentoo Local Security Checks	high
24190	Fedora Core 5 : krb5-1.4.3-5.3 (2007-034)	Nessus	Fedora Local Security Checks	high
24189	Fedora Core 6 : krb5-1.5-13 (2007-033)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2006-6143

critical

Tenable Plugins

high

high

high

critical

high

high

high

high