A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - krb5: Automatic sec context deletion could lead to double-free (CVE-2017-11462)

  - The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka     krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote     authenticated users to forge tickets by leveraging administrative access. (CVE-2014-5351)

  - lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate     context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and     process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call.
    (CVE-2015-2695)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5828-1 advisory.

    It was discovered that Kerberos incorrectly handled certain S4U2Self requests. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 16.04 ESM and Ubuntu     18.04 LTS. (CVE-2018-20217)

    Greg Hudson discovered that Kerberos PAC implementation incorrectly handled certain parsing operations. A     remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.
    (CVE-2022-42898)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2771 advisory.

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

  - MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos     database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by     supplying tagged data that is internal to the database module. (CVE-2018-5729)

  - MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos     database to circumvent a DN containership check by supplying both a linkdn and containerdn database     argument, or by supplying a DN string which is a left extension of a container DN string but is not     hierarchically within the container DN. (CVE-2018-5730)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has     a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
    (CVE-2021-37750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has krb5 packages installed that are affected by a vulnerability:

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has krb5 packages installed that are affected by a vulnerability:

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1374 advisory.

    A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request.(CVE-2018-20217)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Double free vulnerability in MIT Kerberos 5 (aka krb5)     allows attackers to have unspecified impact via vectors     involving automatic deletion of security contexts on     error.(CVE-2017-11462)

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the krb5 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Double free vulnerability in MIT Kerberos 5 (aka krb5)     allows attackers to have unspecified impact via vectors     involving automatic deletion of security contexts on     error.(CVE-2017-11462)

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the krb5 package has been released.

This update for krb5 fixes the following security issue :

  - CVE-2018-20217: Fixed an assertion issue with older     encryption types (bsc#1120489)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

krb5, a MIT Kerberos implementation, had several flaws in LDAP DN checking, which could be used to circumvent a DN containership check by supplying special parameters to some calls.

Further an attacker could crash the KDC by making S4U2Self requests.

For Debian 8 'Jessie', these problems have been fixed in version 1.12.1+dfsg-19+deb8u5.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for krb5 fixes the following issues :

Security issue fixed :

  - CVE-2018-20217: Fixed an assertion issue with older     encryption types (bsc#1120489)

This update was imported from the SUSE:SLE-15:Update update project.

This update for krb5 fixes the following issues :

Security issue fixed :

CVE-2018-20217: Fixed an assertion issue with older encryption types (bsc#1120489)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Improve memset hygiene in one location.

----

Fix low-severity CVE-2018-20217 (an authenticated user who can obtain a TGT using an older encryption type (DES, DES3, or RC4) can cause an assertion failure in the KDC by sending an S4U2Self request.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix low-severity CVE-2018-20217 (an authenticated user who can obtain a TGT using an older encryption type (DES, DES3, or RC4) can cause an assertion failure in the KDC by sending an S4U2Self request.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199166	RHEL 6 : krb5 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
170651	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Kerberos vulnerabilities (USN-5828-1)	Nessus	Ubuntu Local Security Checks	high
153808	Debian DLA-2771-1 : krb5 - LTS security update	Nessus	Debian Local Security Checks	medium
143936	NewStart CGSL CORE 5.05 / MAIN 5.05 : krb5 Vulnerability (NS-SA-2020-0103)	Nessus	NewStart CGSL Local Security Checks	medium
140697	NewStart CGSL CORE 5.04 / MAIN 5.04 : krb5 Vulnerability (NS-SA-2020-0040)	Nessus	NewStart CGSL Local Security Checks	medium
137097	Amazon Linux AMI : krb5 (ALAS-2020-1374)	Nessus	Amazon Linux Local Security Checks	medium
135629	EulerOS Virtualization 3.0.2.2 : krb5 (EulerOS-SA-2020-1467)	Nessus	Huawei Local Security Checks	critical
134481	EulerOS Virtualization for ARM 64 3.0.2.0 : krb5 (EulerOS-SA-2020-1192)	Nessus	Huawei Local Security Checks	critical
132135	EulerOS 2.0 SP3 : krb5 (EulerOS-SA-2019-2600)	Nessus	Huawei Local Security Checks	medium
131870	EulerOS 2.0 SP2 : krb5 (EulerOS-SA-2019-2378)	Nessus	Huawei Local Security Checks	medium
131806	EulerOS 2.0 SP5 : krb5 (EulerOS-SA-2019-2532)	Nessus	Huawei Local Security Checks	medium
126187	Photon OS 1.0: Krb5 PHSA-2019-1.0-0239	Nessus	PhotonOS Local Security Checks	medium
126183	Photon OS 3.0: Krb5 PHSA-2019-3.0-0020	Nessus	PhotonOS Local Security Checks	medium
126181	Photon OS 2.0: Krb5 PHSA-2019-2.0-0164	Nessus	PhotonOS Local Security Checks	medium
121412	openSUSE Security Update : krb5 (openSUSE-2019-85)	Nessus	SuSE Local Security Checks	medium
121399	Debian DLA-1643-1 : krb5 security update	Nessus	Debian Local Security Checks	medium
121287	openSUSE Security Update : krb5 (openSUSE-2019-63)	Nessus	SuSE Local Security Checks	medium
121243	SUSE SLES12 Security Update : krb5 (SUSE-SU-2019:0113-1)	Nessus	SuSE Local Security Checks	medium
121241	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2019:0111-1)	Nessus	SuSE Local Security Checks	medium
121083	Fedora 28 : krb5 (2019-ac7e19b0c8)	Nessus	Fedora Local Security Checks	medium
120564	Fedora 29 : krb5 (2018-7db7ccda4d)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-20217

medium

Tenable Plugins

critical

high

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium