do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.

The remote Solaris system is missing necessary patches to address security updates :

  - do_tgs_req.c in the Key Distribution Center (KDC) in MIT     Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a     single-component realm name is used, allows remote     authenticated users to cause a denial of service (daemon     crash) via a TGS-REQ request that triggers an attempted     cross-realm referral for a host-based service principal.
    (CVE-2013-1417)

  - The setup_server_realm function in main.c in the Key     Distribution Center (KDC) in MIT Kerberos 5 (aka krb5)     before 1.10.7, when multiple realms are configured,     allows remote attackers to cause a denial of service     (NULL pointer dereference and daemon crash) via a     crafted request. (CVE-2013-1418)

the following security issues were fixed in krb5 :

  - Fix a KDC NULL pointer dereference [CVE-2013-1417] that     could affect realms with an uncommon configuration.
    (bnc#850660)     bug-850660-CVE-2013-1417-KDC-null-deref-due-to-referrals     .dif

  - Fix a KDC NULL pointer dereference [CVE-2013-1418] that     could affect KDCs that serve multiple realms.
    (bnc#849240)     bug-849240-CVE-2013-1418-fix-multi-realm-kdc-null-deref.
    dif

The remote host is affected by the vulnerability described in GLSA-201312-12 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Key Distribution       Center in MIT Kerberos 5. Please review the CVE identifiers referenced       below for details.
  Impact :

    A remote attacker could send a specially crafted request, possibly       resulting in execution of arbitrary code with the privileges of the       process or a Denial of Service condition. Additionally, a remote attacker       could impersonate a kadmind server and send a specially crafted packet to       the password change port, which can result in a ping-pong condition and a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update incorporates a fix for a bug which could cause clients which attempted to contact servers using TCP to become wedge. This update incorporates fixes for a possible remotely-triggered crash in KDCs which are configured to serve multiple realms at once (CVE-2013-1418), and another which could occur while the KDC processed certain requests using referrals (CVE-2013-1417).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update incorporates a bug fix to properly reject more invalid names for credential caches, and the fix for CVE-2013-1417, which could cause a KDC to attempt to dereference a NULL pointer.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80654	Oracle Solaris Third-Party Patch Update : kerberos (multiple_vulnerabilities_in_kerberos1)	Nessus	Solaris Local Security Checks	medium
75222	openSUSE Security Update : krb5 (openSUSE-SU-2013:1833-1)	Nessus	SuSE Local Security Checks	medium
71487	GLSA-201312-12 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
71181	Fedora 19 : krb5-1.11.3-13.fc19 (2013-21786)	Nessus	Fedora Local Security Checks	medium
70958	Fedora 20 : krb5-1.11.3-32.fc20 (2013-21456)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2013-1417

medium

Tenable Plugins

medium

medium

high

medium

low