Debian dla-3206 : heimdal-clients - security update

critical Nessus Plugin ID 168205

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3206 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-3206-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin November 26, 2022 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : heimdal Version : 7.5.0+dfsg-3+deb10u1 CVE ID : CVE-2019-14870 CVE-2021-3671 CVE-2021-44758 CVE-2022-3437 CVE-2022-41916 CVE-2022-42898 CVE-2022-44640 Debian Bug : 946786 996586 1024187

Multiple security vulnerabilities were discovered in heimdal, an implementation of the Kerberos 5 authentication protocol, which may result in denial of service, information disclosure, or remote code execution.

CVE-2019-14870

Isaac Boukris reported that the Heimdal KDC before 7.7.1 does not apply delegation_not_allowed (aka not-delegated) user attributes for S4U2Self. Instead the forwardable flag is set even if the impersonated client has the not-delegated flag set.

CVE-2021-3671

Joseph Sutton discovered that the Heimdal KDC before 7.7.1 does not check for missing missing sname in TGS-REQ (Ticket Granting Server - Request) before before dereferencing. An authenticated user could use this flaw to crash the KDC.

CVE-2021-44758

It was discovered that Heimdal is prone to a NULL dereference in acceptors when the initial SPNEGO token has no acceptable mechanisms, which may result in denial of service for a server application that uses the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO).

CVE-2022-3437

Evgeny Legerov reported that the DES and Triple-DES decryption routines in the Heimdal GSSAPI library before 7.7.1 were prone to buffer overflow on malloc() allocated memory when presented with a maliciously small packet. In addition, the Triple-DES and RC4 (arcfour) decryption routine were prone to non-constant time leaks, which could potentially yield to a leak of secret key material when using these ciphers.

CVE-2022-41916

It was discovered that Heimdal's PKI certificate validation library before 7.7.1 can under some circumstances perform an out-of-bounds memory access when normalizing Unicode, which may result in denial of service.

CVE-2022-42898

Greg Hudson discovered an integer multiplication overflow in the Privilege Attribute Certificate (PAC) parsing routine, which may result in denial of service for Heimdal KDCs and possibly Heimdal servers (e.g., via GSS-API) on 32-bit systems.

CVE-2022-44640

Douglas Bagnall and the Heimdal maintainers independently discovered that Heimdal's ASN.1 compiler before 7.7.1 generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free() function on the decoded structure upon decode error, which may result in remote code execution in the Heimdal KDC and possibly the Kerberos client, the X.509 library, and other components as well.

For Debian 10 buster, these problems have been fixed in version 7.5.0+dfsg-3+deb10u1.

We recommend that you upgrade your heimdal packages.

For the detailed security status of heimdal please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/heimdal

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the heimdal-clients packages.

Plugin Details

Severity: Critical

ID: 168205

File Name: debian_DLA-3206.nasl

Version: 1.5

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 11/27/2022

Updated: 1/22/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2019-14870

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2022-44640

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:heimdal-dev, p-cpe:/a:debian:debian_linux:heimdal-multidev, p-cpe:/a:debian:debian_linux:libotp0-heimdal, p-cpe:/a:debian:debian_linux:heimdal-docs, cpe:/o:debian:debian_linux:10.0, p-cpe:/a:debian:debian_linux:libkafs0-heimdal, p-cpe:/a:debian:debian_linux:heimdal-kdc, p-cpe:/a:debian:debian_linux:libheimntlm0-heimdal, p-cpe:/a:debian:debian_linux:libhx509-5-heimdal, p-cpe:/a:debian:debian_linux:libheimbase1-heimdal, p-cpe:/a:debian:debian_linux:libgssapi3-heimdal, p-cpe:/a:debian:debian_linux:libkdc2-heimdal, p-cpe:/a:debian:debian_linux:libasn1-8-heimdal, p-cpe:/a:debian:debian_linux:heimdal-servers, p-cpe:/a:debian:debian_linux:libkadm5clnt7-heimdal, p-cpe:/a:debian:debian_linux:libkrb5-26-heimdal, p-cpe:/a:debian:debian_linux:heimdal-kcm, p-cpe:/a:debian:debian_linux:libhdb9-heimdal, p-cpe:/a:debian:debian_linux:libkadm5srv8-heimdal, p-cpe:/a:debian:debian_linux:libsl0-heimdal, p-cpe:/a:debian:debian_linux:libhcrypto4-heimdal, p-cpe:/a:debian:debian_linux:libwind0-heimdal, p-cpe:/a:debian:debian_linux:heimdal-clients, p-cpe:/a:debian:debian_linux:libroken18-heimdal

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/26/2022

Vulnerability Publication Date: 12/10/2019

Reference Information

CVE: CVE-2019-14870, CVE-2021-3671, CVE-2021-44758, CVE-2022-3437, CVE-2022-41916, CVE-2022-42898, CVE-2022-44640

Detections

Analytics