lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - krb5: Automatic sec context deletion could lead to double-free (CVE-2017-11462)

  - The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka     krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote     authenticated users to forge tickets by leveraging administrative access. (CVE-2014-5351)

  - lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate     context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and     process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.
    (CVE-2015-2695)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - krb5: Buffer overflow in get_matching_data() (CVE-2017-15088)

  - Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

  - The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka     krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote     authenticated users to forge tickets by leveraging administrative access. (CVE-2014-5351)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote host is affected by the vulnerability described in GLSA-201611-14 (MIT Kerberos 5: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MIT Kerberos 5. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

krb5 was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2695: Applications which call     gss_inquire_context() on a partially-established SPNEGO     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952188).

  - CVE-2015-2696: Applications which call     gss_inquire_context() on a partially-established IAKERB     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952189).

  - CVE-2015-2697: Incorrect string handling in     build_principal_va can lead to DOS (bsc#952190).

It was discovered that the Kerberos kpasswd service incorrectly handled certain UDP packets. A remote attacker could possibly use this issue to cause resource consumption, resulting in a denial of service.
This issue only affected Ubuntu 12.04 LTS. (CVE-2002-2443)

It was discovered that Kerberos incorrectly handled null bytes in certain data fields. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-5355)

It was discovered that the Kerberos kdcpreauth modules incorrectly tracked certain client requests. A remote attacker could possibly use this issue to bypass intended preauthentication requirements. This issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2694)

It was discovered that Kerberos incorrectly handled certain SPNEGO packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2695)

It was discovered that Kerberos incorrectly handled certain IAKERB packets. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2696, CVE-2015-2698)

It was discovered that Kerberos incorrectly handled certain TGS requests. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2015-2697).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in krb5, the MIT implementation of Kerberos. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2015-2695     It was discovered that applications which call     gss_inquire_context() on a partially-established SPNEGO     context can cause the GSS-API library to read from a     pointer using the wrong type, leading to a process     crash.

  - CVE-2015-2696     It was discovered that applications which call     gss_inquire_context() on a partially-established IAKERB     context can cause the GSS-API library to read from a     pointer using the wrong type, leading to a process     crash.

  - CVE-2015-2697     It was discovered that the build_principal_va() function     incorrectly handles input strings. An authenticated     attacker can take advantage of this flaw to cause a KDC     to crash using a TGS request with a large realm field     beginning with a null byte.

krb5 was updated to fix three security issues.

These security issues were fixed :

  - CVE-2015-2695: Applications which call     gss_inquire_context() on a partially-established SPNEGO     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952188).

  - CVE-2015-2696: Applications which call     gss_inquire_context() on a partially-established IAKERB     context could have caused the GSS-API library to read     from a pointer using the wrong type, generally causing a     process crash. (bsc#952189).

  - CVE-2015-2697: Incorrect string handling in     build_principal_va can lead to DOS (bsc#952190).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199166	RHEL 6 : krb5 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199136	RHEL 7 : krb5 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
95021	GLSA-201611-14 : MIT Kerberos 5: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
86963	openSUSE Security Update : krb5 (openSUSE-2015-740)	Nessus	SuSE Local Security Checks	high
86872	Ubuntu 14.04 LTS : Kerberos vulnerabilities (USN-2810-1)	Nessus	Ubuntu Local Security Checks	high
86800	openSUSE Security Update : krb5 (openSUSE-2015-709)	Nessus	SuSE Local Security Checks	high
86795	Debian DSA-3395-1 : krb5 - security update	Nessus	Debian Local Security Checks	high
86754	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2015:1897-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2015-2696

high

Tenable Plugins

critical

critical

high

high

high

high

high

high