In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - krb5: Automatic sec context deletion could lead to double-free (CVE-2017-11462)

  - The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka     krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote     authenticated users to forge tickets by leveraging administrative access. (CVE-2014-5351)

  - lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate     context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and     process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.
    (CVE-2015-2695)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

According to the versions of the krb5 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Kerberos is a network authentication system. The     krb5-server package contains the programs that must be     installed on a Kerberos 5 key distribution center     (KDC). If you are installing a Kerberos 5 KDC, you need     to install this package (in other words, most people     should NOT install this package). Security Fix(es):MIT     Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before     1.18.3 allows unbounded recursion via an ASN.1-encoded     Kerberos message because the     lib/krb5/asn.1/asn1_encode.c support for BER indefinite     lengths lacks a recursion limit.(CVE-2020-28196)In MIT     Kerberos 5 (aka krb5) 1.7 and later, an authenticated     attacker can cause a KDC assertion failure by sending     invalid S4U2Self or S4U2Proxy requests.(CVE-2017-11368)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has krb5 packages installed that are affected by multiple vulnerabilities:

  - An authentication bypass flaw was found in the way     krb5's certauth interface handled the validation of     client certificates. A remote attacker able to     communicate with the KDC could potentially use this flaw     to impersonate arbitrary principals under rare and     erroneous circumstances. (CVE-2017-7562)

  - A denial of service flaw was found in MIT Kerberos     krb5kdc service. An authenticated attacker could use     this flaw to cause krb5kdc to exit with an assertion     failure by making an invalid S4U2Self or S4U2Proxy     request. (CVE-2017-11368)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An authentication bypass flaw was found in the way     krb5's certauth interface handled the validation of     client certificates. A remote attacker able to     communicate with the KDC could potentially use this     flaw to impersonate arbitrary principals under rare and     erroneous circumstances. (CVE-2017-7562)

  - A denial of service flaw was found in MIT Kerberos     krb5kdc service. An authenticated attacker could use     this flaw to cause krb5kdc to exit with an assertion     failure by making an invalid S4U2Self or S4U2Proxy     request.i1/4^CVE-2017-11368i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An authentication bypass flaw was found in the way     krb5's certauth interface before 1.16.1 handled the     validation of client certificates. A remote attacker     able to communicate with the KDC could potentially use     this flaw to impersonate arbitrary principals under     rare and erroneous circumstances.(CVE-2017-7562)

  - In MIT Kerberos 5 (aka krb5) 1.7 and later, an     authenticated attacker can cause a KDC assertion     failure by sending invalid S4U2Self or S4U2Proxy     requests.(CVE-2017-11368)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service flaw was found in MIT Kerberos     krb5kdc service. An authenticated attacker could use     this flaw to cause krb5kdc to exit with an assertion     failure by making an invalid S4U2Self or S4U2Proxy     request.(CVE-2017-11368)

  - An authentication bypass flaw was found in the way     krb5's certauth interface handled the validation of     client certificates. A remote attacker able to     communicate with the KDC could potentially use this     flaw to impersonate arbitrary principals under rare and     erroneous circumstances.(CVE-2017-7562)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A denial of service flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request.(CVE-2017-11368)

An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.(CVE-2017-7562)

Authentication bypass by improper validation of certificate EKU and SAN

An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.(CVE-2017-7562)

Invalid S4U2Self or S4U2Proxy request causes assertion failure

A denial of service flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request.( CVE-2017-11368)

Security Fix(es) :

  - krb5: Authentication bypass by improper validation of     certificate EKU and SAN (CVE-2017-7562)

  - krb5: Invalid S4U2Self or S4U2Proxy request causes     assertion failure (CVE-2017-11368)

Additional Changes :

An update for krb5 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es) :

* krb5: Authentication bypass by improper validation of certificate EKU and SAN (CVE-2017-7562)

* krb5: Invalid S4U2Self or S4U2Proxy request causes assertion failure (CVE-2017-11368)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

From Red Hat Security Advisory 2018:0666 :

An update for krb5 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es) :

* krb5: Authentication bypass by improper validation of certificate EKU and SAN (CVE-2017-7562)

* krb5: Invalid S4U2Self or S4U2Proxy request causes assertion failure (CVE-2017-11368)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0666 advisory.

  - krb5: Authentication bypass by improper validation of certificate EKU and SAN (CVE-2017-7562)

  - krb5: Invalid S4U2Self or S4U2Proxy request causes assertion failure (CVE-2017-11368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

MIT reports :

CVE-2017-11368 :

In MIT krb5 1.7 and later, an authenticated attacker can cause an assertion failure in krb5kdc by sending an invalid S4U2Self or S4U2Proxy request.

CVE-2017-11462 :

RFC 2744 permits a GSS-API implementation to delete an existing security context on a second or subsequent call to gss_init_sec_context() or gss_accept_sec_context() if the call results in an error. This API behavior has been found to be dangerous, leading to the possibility of memory errors in some callers. For safety, GSS-API implementations should instead preserve existing security contexts on error until the caller deletes them.

All versions of MIT krb5 prior to this change may delete acceptor contexts on error. Versions 1.13.4 through 1.13.7, 1.14.1 through 1.14.5, and 1.15 through 1.15.1 may also delete initiator contexts on error.

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u8.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2017-11368 (remote triggerable assertion failure in krb5kdc)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199166	RHEL 6 : krb5 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
147526	EulerOS Virtualization for ARM 64 3.0.2.0 : krb5 (EulerOS-SA-2021-1403)	Nessus	Huawei Local Security Checks	high
127186	NewStart CGSL CORE 5.04 / MAIN 5.04 : krb5 Multiple Vulnerabilities (NS-SA-2019-0025)	Nessus	NewStart CGSL Local Security Checks	medium
123853	EulerOS Virtualization 2.5.3 : krb5 (EulerOS-SA-2019-1167)	Nessus	Huawei Local Security Checks	medium
119897	EulerOS Virtualization 2.5.2 : krb5 (EulerOS-SA-2018-1408)	Nessus	Huawei Local Security Checks	medium
118755	EulerOS 2.0 SP3 : krb5 (EulerOS-SA-2018-1361)	Nessus	Huawei Local Security Checks	medium
118737	EulerOS 2.0 SP2 : krb5 (EulerOS-SA-2018-1354)	Nessus	Huawei Local Security Checks	medium
117342	Amazon Linux AMI : krb5 (ALAS-2018-1010)	Nessus	Amazon Linux Local Security Checks	medium
109689	Amazon Linux 2 : krb5 (ALAS-2018-1010)	Nessus	Amazon Linux Local Security Checks	medium
109450	Scientific Linux Security Update : krb5 on SL7.x x86_64 (20180410)	Nessus	Scientific Linux Local Security Checks	medium
109370	CentOS 7 : krb5 (CESA-2018:0666)	Nessus	CentOS Local Security Checks	medium
109104	Oracle Linux 7 : krb5 (ELSA-2018-0666)	Nessus	Oracle Linux Local Security Checks	medium
108983	RHEL 7 : krb5 (RHSA-2018:0666)	Nessus	Red Hat Local Security Checks	medium
103953	FreeBSD : krb5 -- Multiple vulnerabilities (3f3837cc-48fb-4414-aa46-5b1c23c9feae)	Nessus	FreeBSD Local Security Checks	critical
102482	Debian DLA-1058-1 : krb5 security update	Nessus	Debian Local Security Checks	medium
102002	Fedora 25 : krb5 (2017-8e9d9771c4)	Nessus	Fedora Local Security Checks	medium
101997	Fedora 24 : krb5 (2017-71c47e1e82)	Nessus	Fedora Local Security Checks	medium
101965	Fedora 26 : krb5 (2017-e5b36383f4)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2017-11368

medium

Tenable Plugins

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium