The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - krb5: Automatic sec context deletion could lead to double-free (CVE-2017-11462)

  - The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka     krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote     authenticated users to forge tickets by leveraging administrative access. (CVE-2014-5351)

  - lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate     context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and     process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.
    (CVE-2015-2695)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

An update of the krb5 package has been released.

Kerberos, a system for authenticating users and services on a network, was affected by several vulnerabilities. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2013-1418 Kerberos allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request when multiple realms are configured.

CVE-2014-5351 Kerberos sends old keys in a response to a -randkey
-keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.

CVE-2014-5353 When the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

CVE-2014-5355 Kerberos expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character,

CVE-2016-3119 Kerberos allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.

CVE-2016-3120 Kerberos allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u9.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker     with permission to modify a principal entry could use     this flaw to cause kadmind to dereference a NULL     pointer and crash by supplying an empty DB argument to     the modify_principal command, if kadmind was configured     to use the LDAP KDB module. (CVE-2016-3119)

  - A NULL pointer dereference flaw was found in MIT     Kerberos krb5kdc service. An authenticated attacker     could use this flaw to cause krb5kdc to dereference a     NULL pointer and crash by making an S4U2Self request,     if the restrict_anonymous_to_tgt option was set to     true.(CVE-2016-3120)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a NULL pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module. (CVE-2016-3119)

A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a NULL pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true.
(CVE-2016-3120)

The following packages have been upgraded to a newer upstream version:
krb5 (1.14.1).

Security Fix(es) :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker with     permission to modify a principal entry could use this     flaw to cause kadmind to dereference a NULL pointer and     crash by supplying an empty DB argument to the     modify_principal command, if kadmind was configured to     use the LDAP KDB module. (CVE-2016-3119)

  - A NULL pointer dereference flaw was found in MIT     Kerberos krb5kdc service. An authenticated attacker     could use this flaw to cause krb5kdc to dereference a     NULL pointer and crash by making an S4U2Self request, if     the restrict_anonymous_to_tgt option was set to true.
    (CVE-2016-3120)

Additional Changes :

An update for krb5 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

The following packages have been upgraded to a newer upstream version:
krb5 (1.14.1). (BZ#1292153)

Security Fix(es) :

* A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a NULL pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module. (CVE-2016-3119)

* A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a NULL pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true.
(CVE-2016-3120)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2591 advisory.

    - Fix CVE-2016-3120
    - Fix CVE-2016-3119 (LDAP NULL dereference)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for krb5 fixes the following issues :

  - CVE-2016-3120: KDC NULL pointer Dereference Denial Of     Service Vulnerability (bsc#991088)

This update was imported from the SUSE:SLE-12:Update update project.

This update for krb5 fixes the following issues :

  - CVE-2016-3120: KDC NULL pointer Dereference Denial Of     Service Vulnerability (bsc#991088)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Bump version to 1.14.3 for the convenience of those needing the SNI fix.

----

Require krb5 to set the 'Host:' header when speaking KKDCPP. This fixes use of TLS with SNI.

----

Fix low-impact CVE-2016-3120 where S4U2Self may cause KDC crash when anon is restricted

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Misc samba and sssd-related bugfixes.

----

Bump version to 1.14.3 for the convenience of those needing the SNI fix.

----

Require krb5 to set the 'Host:' header when speaking KKDCPP. This fixes use of TLS with SNI.

----

Fix low-impact CVE-2016-3120 where S4U2Self may cause KDC crash when anon is restricted

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix low-impact CVE-2016-3120 where S4U2Self may cause KDC crash when anon is restricted

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Major changes in krb5 1.14.3 and krb5 1.13.6 :

Fix a rare KDC denial of service vulnerability when anonymous client principals are restricted to obtaining TGTs only [CVE-2016-3120] .

ID	Name	Product	Family	Severity
199166	RHEL 6 : krb5 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
121701	Photon OS 1.0: Krb5 PHSA-2017-0021	Nessus	PhotonOS Local Security Checks	medium
106536	Debian DLA-1265-1 : krb5 security update	Nessus	Debian Local Security Checks	medium
99836	EulerOS 2.0 SP1 : krb5 (EulerOS-SA-2016-1076)	Nessus	Huawei Local Security Checks	medium
97023	Amazon Linux AMI : krb5 (ALAS-2017-793)	Nessus	Amazon Linux Local Security Checks	medium
95842	Scientific Linux Security Update : krb5 on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95337	CentOS 7 : krb5 (CESA-2016:2591)	Nessus	CentOS Local Security Checks	medium
94712	Oracle Linux 7 : krb5 (ELSA-2016-2591)	Nessus	Oracle Linux Local Security Checks	medium
94554	RHEL 7 : krb5 (RHSA-2016:2591)	Nessus	Red Hat Local Security Checks	medium
93393	openSUSE Security Update : krb5 (openSUSE-2016-1065)	Nessus	SuSE Local Security Checks	medium
93303	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2016:2136-1)	Nessus	SuSE Local Security Checks	medium
93266	Fedora 23 : krb5 (2016-f405b25923)	Nessus	Fedora Local Security Checks	medium
93262	Fedora 23 : krb5 (2016-4a36663643)	Nessus	Fedora Local Security Checks	medium
92668	Fedora 24 : krb5 (2016-0674a3c372)	Nessus	Fedora Local Security Checks	medium
92503	FreeBSD : krb5 -- KDC denial of service vulnerability (62d45229-4fa0-11e6-9d13-206a8a720317)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2016-3120

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium