MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities :

  - Multiple forgery vulnerabilities exist in the bundled     version of MIT Kerberos 5 (krb5). An attacker can     exploit these issues to impersonate a client, escalate     privileges, and disclose sensitive information.
    (CVE-2010-1323, CVE-2010-1324, CVE-2010-4020,     CVE-2010-4021)

  - A local arbitrary code execution vulnerability exists in     the Kernel in the do_anonymous_page() function due to     improper separation of the stack and the heap. A local     attacker can exploit this vulnerability to execute     arbitrary code. (CVE-2010-2240)

  - A denial of service vulnerability exists that allows a     remote attacker to exhaust available sockets, preventing     further connections. (CVE-2011-1785)

  - A denial of service vulnerability exists in the bundled     version of lsassd in Likewise Open. A remote attacker     can exploit this, via an Active Directory login attempt     that provides a username containing an invalid byte     sequence, to cause a daemon crash. (CVE-2011-1786)

The Oracle Secure Global Desktop installed on the remote host is version 4.63 / 4.71 / 5.1 / 5.2. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists in Kerberos 5 due     to a failure to properly determine the acceptability of     checksums. A remote attacker can exploit this to forge     tokens or gain privileges by using an unkeyed checksum.
    (CVE-2010-1324)

  - A NULL pointer deference flaw exists in the function     bdfReadCharacters() in file bdfread.c of the X.Org     libXfont module due to improper handling of non-readable     character bitmaps. An authenticated, remote attacker,     using a crafted BDF font file, can exploit this to     cause a denial of service or execute arbitrary code.
    (CVE-2015-1803)

  - An out-of-bounds read/write error exists in the     SProcXFixesSelectSelectionInput() function in the     XFixes extension. A remote, authenticated attacker,     using a crafted length value, can exploit this to     cause a denial of service or execute arbitrary code.
    (CVE-2014-8102)

  - A remote attacker, by using a crafted string length     value in an XkbSetGeometry request, can gain access to     sensitive information from process memory or cause a     denial of service. (CVE-2015-0255)

  - An invalid read error exists in the ASN1_TYPE_cmp()     function due to improperly performed boolean-type     comparisons. A remote attacker can exploit this, via a     crafted X.509 certificate to an endpoint that uses the     certificate-verification feature, to cause an invalid     read operation, resulting in a denial of service.
    (CVE-2015-0286)

  - A denial of service vulnerability exists in Apache     Tomcat due to improper handling of HTTP responses     that occurs before finishing reading an entire request     body. A remote attacker can exploit this by using a     crafted series of aborted upload attempts.
    (CVE-2014-0230)

  - A denial of service vulnerability exists in Apache     Tomcat in ChunkedInputFilter.java due to improper     handling of attempts to read data after an error has     occurred. A remote attacker can exploit this by     streaming data with malformed chunked-transfer     encoding. (CVE-2014-0227)

  - A NULL pointer dereference flaw exists in the     dtls1_get_record() function when handling DTLS messages.
    A remote attacker, using a specially crafted DTLS     message, can cause a denial of service. (CVE-2014-3571)

  - An unspecified flaw exists that is related to the     JServer subcomponent. A remote attacker can exploit this     to impact confidentiality and integrity. No further     details have been provided. (CVE-2015-2581)

The remote Solaris system is missing necessary patches to address security updates :

  - The merge_authdata function in kdc_authdata.c in the Key     Distribution Center (KDC) in MIT Kerberos 5 (aka krb5)     1.8.x before 1.8.4 does not properly manage an index     into an authorization-data list, which allows remote     attackers to cause a denial of service (daemon crash),     or possibly obtain sensitive information, spoof     authorization, or execute arbitrary code, via a TGS     request that triggers an uninitialized pointer     dereference, as demonstrated by a request from a Windows     Active Directory client. (CVE-2010-1322)

  - MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x,     1.7.x, and 1.8.x through 1.8.3 does not properly     determine the acceptability of checksums, which might     allow remote attackers to modify user-visible prompt     text, modify a response to a Key Distribution Center     (KDC), or forge a KRB-SAFE message via certain checksums     that (1) are unkeyed or (2) use RC4 keys.
    (CVE-2010-1323)

  - MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3     does not properly determine the acceptability of     checksums, which might allow remote attackers to forge     GSS tokens, gain privileges, or have unspecified other     impact via (1) an unkeyed checksum, (2) an unkeyed PAC     checksum, or (3) a KrbFastArmoredReq checksum based on     an RC4 key. (CVE-2010-1324)

  - MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not     reject RC4 key-derivation checksums, which might allow     remote authenticated users to forge a (1) AD-SIGNEDPATH     or (2) AD-KDC-ISSUED signature, and possibly gain     privileges, by leveraging the small key space that     results from certain one-byte stream-cipher operations.
    (CVE-2010-4020)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka     krb5) 1.7 does not properly restrict the use of TGT     credentials for armoring TGS requests, which might allow     remote authenticated users to impersonate a client by     rewriting an inner request, aka a 'KrbFastReq forgery     issue.' (CVE-2010-4021)

  - Double free vulnerability in the prepare_error_as     function in do_as_req.c in the Key Distribution Center     (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when     the PKINIT feature is enabled, allows remote attackers     to cause a denial of service (daemon crash) or possibly     execute arbitrary code via an e_data field containing     typed data. (CVE-2011-0284)

Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software. CVE-2010-1323, CVE-2010-1324,CVE-2010-4020 and CVE-2010-4021 have been assigned to this issue.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0200 advisory.

    - add upstream patches to fix standalone kpropd exiting if the per-client       child process exits with an error, and hang or crash in the KDC when using       the LDAP kdb backend (CVE-2010-4022, CVE-2011-0281, CVE-2011-0282, #671101)
    - incorporate candidate patch to fix various issues from MITKRB5-SA-2010-007       (CVE-2010-1323, CVE-2010-1324, CVE-2010-4020, #651962)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201201-13 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the administration daemon or the Key Distribution Center       (KDC) daemon, cause a Denial of Service condition, or possibly obtain       sensitive information. Furthermore, a remote attacker may be able to       spoof Kerberos authorization, modify KDC responses, forge user data       messages, forge tokens, forge signatures, impersonate a client, modify       user-visible prompt text, or have other unspecified impact.
  Workaround :

    There is no known workaround at this time.

a. ESX/ESXi Socket Exhaustion   By sending malicious network traffic to an ESXi or ESX host an  attacker could exhaust the available sockets which would prevent  further connections to the host. In the event a host becomes  inaccessible its virtual machines will continue to run and have  network connectivity but a reboot of the ESXi or ESX host may be  required in order to be able to connect to the host again.

 ESXi and ESX hosts may intermittently lose connectivity caused by  applications that do not correctly close sockets. If this occurs an  error message similar to the following may be written to the vpxa  log :
      socket() returns -1 (Cannot allocate memory)

  An error message similar to the following may be written to the   vmkernel logs :

     socreate(type=2, proto=17) failed with error 55

  VMware would like to thank Jimmy Scott at inet-solutions.be for   reporting this issue to us.

  The Common Vulnerabilities and Exposures Project (cve.mitre.org) has   assigned the name CVE-2011-1785 to this issue.

b. Likewise package update    Updates to the vmware-esx-likewise-openldap and   vmware-esx-likewise-krb5 packages address several security issues.

  One of the vulnerabilities is specific to Likewise while the other   vulnerabilities are present in the MIT version of krb5.
  An incorrect assert() call in Likewise may lead to a termination   of the Likewise-open lsassd service if a username with an illegal   byte sequence is entered for user authentication when logging in to   the Active Directory domain of the ESXi/ESX host. This would lead to   a denial of service.
  The MIT-krb5 vulnerabilities are detailed in MITKRB5-SA-2010-007.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the names CVE-2011-1786 (Likewise-only issue),   CVE-2010-1324, CVE-2010-1323, CVE-2010-4020, CVE-2010-4021 to these   issues.

c. ESX third-party update for Service Console kernel    The Service Console kernel is updated to include a fix for a   security issue.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the name CVE-2010-2240 to this issue.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.7.

Mac OS X 10.6.7 contains security fixes for the following products :

  - AirPort
  - Apache
  - AppleScript
  - ATS
  - bzip2
  - CarbonCore
  - ClamAV
  - CoreText
  - File Quarantine
  - HFS
  - ImageIO
  - Image RAW
  - Installer
  - Kerberos
  - Kernel
  - Libinfo
  - libxml
  - Mailman
  - PHP
  - QuickLook
  - QuickTime
  - Ruby
  - Samba
  - Subversion
  - Terminal
  - X11

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11
IAVB Reference : 2010-B-0083
STIG Finding Severity : Category II

Versions of Mac OS X 10.6 earlier than 10.6.7 are potentially affected by a security issue.  Mac OS X 10.6.7 contains a security fix for the following products :

  - Airport

  - Apache

  - AppleScript

  - ATS

  - bzip2

  - CarbonCore

  - ClamAV

  - CoreText

  - HFS

  - ImageIO

  - Image RAW

  - Installer

  - Kerberos

  - Kernel

  - Libinfo

  - libxml

  - Mailman

  - PHP

  - QuickLook

  - QuickTime

  - Ruby

  - Samba

  - Subversion

  - Terminal

  - X11

s700_800 11.31 KRB5-Client Version 1.3.5.03 Cumulative patch : 

Potential security vulnerabilities have been identified on HP-UX running Kerberos. These vulnerabilities could be exploited remotely by an unauthorized user to modify data, prompts, or responses.

Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software.

It was discovered that Kerberos did not properly determine the acceptability of certain checksums. A remote attacker could use certain checksums to alter the prompt message, modify a response to a Key Distribution Center (KDC) or forge a KRB-SAFE message.
(CVE-2010-1323)

It was discovered that Kerberos did not properly determine the acceptability of certain checksums. A remote attacker could use certain checksums to forge GSS tokens or gain privileges. This issue only affected Ubuntu 9.10, 10.04 LTS and 10.10. (CVE-2010-1324)

It was discovered that Kerberos did not reject RC4 key-derivation checksums. An authenticated remote user could use this issue to forge AD-SIGNEDPATH or AD-KDC-ISSUED signatures and possibly gain privileges. This issue only affected Ubuntu 10.04 LTS and 10.10.
(CVE-2010-4020)

It was discovered that Kerberos did not properly restrict the use of TGT credentials for armoring TGS requests. A remote authenticated user could use this flaw to impersonate a client. This issue only affected Ubuntu 9.10. (CVE-2010-4021).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The MIT Kerberos team reports :

MIT krb5 incorrectly accepts an unkeyed checksum for PAC signatures.

An authenticated remote attacker can forge PACs if using a KDC that does not filter client-provided PAC data. This can result in privilege escalation against a service that relies on PAC contents to make authorization decisions.

The MIT Kerberos team reports :

MIT krb incorrectly accepts an unkeyed checksum with DES session keys for version 2 (RFC 4121) of the GSS-API krb5 mechanism.

An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted pre-existing application session uses a DES session key.

MIT krb5 KDC incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying the req-checksum in a KrbFastArmoredReq.

An unauthenticated remote attacker has a 1/256 chance of swapping a client-issued KrbFastReq into a different KDC-REQ, if the armor key is RC4. The consequences are believed to be minor.

This update incorporates the upstream patches to correct bugs outlined in MITKRB5-SA-2010-007 (CVE-2010-1323, CVE-2010-1324, and CVE-2010-4020).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms. (CVE-2010-1323)

Red Hat would like to thank the MIT Kerberos Team for reporting these issues.

All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0925 advisory.

  - krb5: incorrect acceptance of certain checksums (MITKRB5-SA-2010-007) (CVE-2010-1323)

  - krb5: multiple checksum handling vulnerabilities (MITKRB5-SA-2010-007) (CVE-2010-1324)

  - krb5: krb5 may accept authdata checksums with low-entropy derived keys (MITKRB5-SA-2010-007)     (CVE-2010-4020)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered and corrected in krb5 :

An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token. An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages (CVE-2010-1323).

An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted pre-existing application session uses a DES session key. An authenticated remote attacker can forge PACs if using a KDC that does not filter client-provided PAC data. This can result in privilege escalation against a service that relies on PAC contents to make authorization decisions. An unauthenticated remote attacker has a 1/256 chance of swapping a client-issued KrbFastReq into a different KDC-REQ, if the armor key is RC4. The consequences are believed to be minor (CVE-2010-1324).

An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the AD-SIGNEDPATH signature if the TGT key is RC4, allowing it to use self-generated evidence tickets for S4U2Proxy, instead of tickets obtained from the user or with S4U2Self. Configurations using RC4 for the TGT key are believed to be rare. An authenticated remote attacker has a 1/256 chance of forging AD-KDC-ISSUED signatures on authdata elements in tickets having an RC4 service key, resulting in privilege escalation against a service that relies on these signatures. There are no known uses of the KDC-ISSUED authdata container at this time (CVE-2010-4020.

An authenticated remote attacker that controls a legitimate service principal could obtain a valid service ticket to itself containing valid KDC-generated authorization data for a client whose TGS-REQ it has intercepted. The attacker could then use this ticket for S4U2Proxy to impersonate the targeted client even if the client never authenticated to the subverted service. The vulnerable configuration is believed to be rare (CVE-2010-4021).

The updated packages have been patched to correct this issue.

ID	Name	Product	Family	Severity
89676	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0007) (remote check)	Nessus	Misc.	high
84795	Oracle Secure Global Desktop Multiple Vulnerabilities (July 2015 CPU)	Nessus	Misc.	high
80653	Oracle Solaris Third-Party Patch Update : kerberos (cve_2010_1322_improper_input)	Nessus	Solaris Local Security Checks	medium
75559	openSUSE Security Update : krb5 (openSUSE-SU-2010:1053-1)	Nessus	SuSE Local Security Checks	medium
68196	Oracle Linux 6 : krb5 (ELSA-2011-0200)	Nessus	Oracle Linux Local Security Checks	medium
57655	GLSA-201201-13 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
53742	openSUSE Security Update : krb5 (openSUSE-SU-2010:1053-1)	Nessus	SuSE Local Security Checks	medium
53672	openSUSE Security Update : krb5 (openSUSE-SU-2010:1053-1)	Nessus	SuSE Local Security Checks	medium
53592	VMSA-2011-0007 : VMware ESXi and ESX Denial of Service and third-party updates for Likewise components and ESX Service Console	Nessus	VMware ESX Local Security Checks	medium
52754	Mac OS X 10.6.x < 10.6.7 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
800796	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5826	Mac OS X 10.6 < 10.6.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
51659	HP-UX PHSS_41775 : HP-UX Running Kerberos, Remote Unauthorized Modification (HPSBUX02623 SSRT100355 rev.1)	Nessus	HP-UX Local Security Checks	low
51159	SuSE 10 Security Update : krb5 (ZYPP Patch Number 7243)	Nessus	SuSE Local Security Checks	medium
51116	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : krb5 vulnerabilities (USN-1030-1)	Nessus	Ubuntu Local Security Checks	medium
51104	FreeBSD : krb5 -- unkeyed PAC checksum handling vulnerability (9f971cea-03f5-11e0-bf50-001a926c7637)	Nessus	FreeBSD Local Security Checks	low
51100	FreeBSD : krb5 -- multiple checksum handling vulnerabilities (0d57c1d9-03f4-11e0-bf50-001a926c7637)	Nessus	FreeBSD Local Security Checks	low
51099	Fedora 13 : krb5-1.7.1-16.fc13 (2010-18425)	Nessus	Fedora Local Security Checks	medium
51083	Fedora 14 : krb5-1.8.2-7.fc14 (2010-18409)	Nessus	Fedora Local Security Checks	medium
50974	SuSE 11 / 11.1 Security Update : krb5 (SAT Patch Numbers 3547 / 3549)	Nessus	SuSE Local Security Checks	medium
50863	CentOS 4 / 5 : krb5 (CESA-2010:0926)	Nessus	CentOS Local Security Checks	medium
50852	RHEL 6 : krb5 (RHSA-2010:0925)	Nessus	Red Hat Local Security Checks	medium
50849	Mandriva Linux Security Advisory : krb5 (MDVSA-2010:246)	Nessus	Mandriva Local Security Checks	medium

Detections

Analytics

CVE-2010-1324

low

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

high

high

critical

low

medium

medium

low

low

medium

medium

medium

medium

medium

medium