Detections
Analytics
Fedora Core 2 : krb5-1.3.4-6 (2004-277)
high Nessus Plugin ID 14593
Synopsis
The remote Fedora Core host is missing a security update.Description
Kerberos is a networked authentication system which uses a trusted third-party (a KDC) to authenticate clients and servers to each other.Several double-free bugs were found in the Kerberos 5 KDC and libraries. A remote attacker could potentially exploit these flaws to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0642 and CVE-2004-0643 to these issues.
A double-free bug was also found in the krb524 server (CVE-2004-0772), however this issue does not affect Fedora Core.
An infinite loop bug was found in the Kerberos 5 ASN.1 decoder library. A remote attacker may be able to trigger this flaw and cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0644 to this issue.
Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 14593
File Name: fedora_2004-277.nasl
Version: 1.22
Type: local
Agent: unix
Family: Fedora Local Security Checks
Published: 8/31/2004
Updated: 1/11/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:fedoraproject:fedora:krb5-server, cpe:/o:fedoraproject:fedora_core:2, p-cpe:/a:fedoraproject:fedora:krb5-workstation, p-cpe:/a:fedoraproject:fedora:krb5-libs, p-cpe:/a:fedoraproject:fedora:krb5-debuginfo, p-cpe:/a:fedoraproject:fedora:krb5-devel
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list
Patch Publication Date: 8/31/2004
Reference Information
CVE: CVE-2004-0642, CVE-2004-0643