Detections
Analytics
RHEL 2.1 : krb5 (RHSA-2004:448)
high Nessus Plugin ID 14596
Synopsis
The remote Red Hat host is missing one or more security updates.Description
Updated Kerberos (krb5) packages that correct double-free and ASN.1 parsing bugs are now available for Red Hat Enterprise Linux.Kerberos is a networked authentication system that uses a trusted third party (a KDC) to authenticate clients and servers to each other.
Several double-free bugs were found in the Kerberos 5 KDC and libraries. A remote attacker could potentially exploit these flaws to execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2004-0642 and CVE-2004-0643 to these issues.
A double-free bug was also found in the krb524 server (CVE-2004-0772), however this issue was fixed for Red Hat Enterprise Linux 2.1 users by a previous erratum, RHSA-2003:052.
An infinite loop bug was found in the Kerberos 5 ASN.1 decoder library. A remote attacker may be able to trigger this flaw and cause a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0644 to this issue.
All users of krb5 should upgrade to these updated packages, which contain backported security patches to resolve these issues.
Solution
Update the affected packages.See Also
https://access.redhat.com/security/cve/cve-2004-0642
https://access.redhat.com/security/cve/cve-2004-0643
https://access.redhat.com/security/cve/cve-2004-0644
Plugin Details
Severity: High
ID: 14596
File Name: redhat-RHSA-2004-448.nasl
Version: 1.30
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 9/1/2004
Updated: 1/14/2021
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:krb5-workstation, p-cpe:/a:redhat:enterprise_linux:krb5-server, cpe:/o:redhat:enterprise_linux:2.1, p-cpe:/a:redhat:enterprise_linux:krb5-libs, p-cpe:/a:redhat:enterprise_linux:krb5-devel
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Patch Publication Date: 8/31/2004
Vulnerability Publication Date: 9/28/2004