Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other Kerberos user principals.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4530-1 advisory.

    Wolfgang Schweer discovered that Debian-LAN did not properly handle ACLs for the Kerberos admin server. A     local attacker could possibly use this issue to change the passwords of other users, leading to root     privilege escalation. (CVE-2019-3467)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In debian-lan-config < 0.26, configured too permissive ACLs for the Kerberos admin server allowed password changes for other Kerberos user principals.

For Debian 8 'Jessie', this problem has been fixed in version 0.19+deb8u2.

We recommend that you upgrade your debian-lan-config packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that debian-lan-config, a FAI config space for the Debian-LAN system, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals.

This update provides a fixed configuration for new deployments, for existing setups, the NEWS file shipped in this update provides advice to fix the configuration.

It was discovered that debian-edu-config, a set of configuration files used for the Debian Edu blend, configured too permissive ACLs for the Kerberos admin server, which allowed password changes for other user principals.

It was discovered that debian-edu-config, the package containing the configuration files and scripts for Debian Edu (Skolelinux), contained an insecure configuration for kadmin, the Kerberos administration server. The insecure configuration allowed every user to change other users' passwords, thus impersonating them and possibly gaining their privileges.

The bug was not exposed in the officially documented user management frontends of Debian Edu, but could be abused by local network users knowing how to use the Kerberos backend.

For Debian 8 'Jessie', this problem has been fixed in version 1.818+deb8u3.

We recommend that you upgrade your debian-edu-config packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
140751	Ubuntu 18.04 LTS : Debian-LAN vulnerabilities (USN-4530-1)	Nessus	Ubuntu Local Security Checks	high
132941	Debian DLA-2063-1 : debian-lan-config security update	Nessus	Debian Local Security Checks	high
132426	Debian DSA-4595-1 : debian-lan-config - security update	Nessus	Debian Local Security Checks	high
132269	Debian DSA-4589-1 : debian-edu-config - security update	Nessus	Debian Local Security Checks	high
132267	Debian DLA-2041-1 : debian-edu-config security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2019-3467

high

Tenable Plugins

high

high

high

high

high