The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3206 advisory.

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue,     where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be     opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by     forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD     DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the     not-delegated flag set. (CVE-2019-14870)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ     (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a     denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via     PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users     should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. (CVE-2022-41916)

  - The vulnerability exists due to a boundary error within the GSSAPI unwrap_des() and unwrap_des3() routines     of Heimdal. A remote user can send specially crafted data to the application, trigger a heap-based buffer     overflow and perform a denial of service (DoS) attack. (CVE-2022-3437)

  - The Kerberos libraries used by Samba provide a mechanism for authenticating a user or service by means of     tickets that can contain Privilege Attribute Certificates (PACs). Both the Heimdal and MIT Kerberos     libraries, and so the embedded Heimdal shipped by Samba suffer from an integer multiplication overflow     when calculating how many bytes to allocate for a buffer for the parsed PAC. On a 32-bit system an     overflow allows placement of 16-byte chunks of entirely attacker- controlled data. (Because the user's     control over this calculation is limited to an unsigned 32-bit value, 64-bit systems are not impacted).
    The server most vulnerable is the KDC, as it will parse an attacker-controlled PAC in the S4U2Proxy     handler. The secondary risk is to Kerberos-enabled file server installations in a non-AD realm. A non-AD     Heimdal KDC controlling such a realm may pass on an attacker-controlled PAC within the service ticket.
    (CVE-2022-42898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3206-1 : heimdal - LTS security update

critical Nessus Plugin ID 168205

Version 1.4

Version 1.3

Version 1.2

Version 1.4 Sep 20, 2023, 4:09 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309201609
Version 1.3 Jan 5, 2023, 6:23 PM CVSS metrics ("CVSSv3 score" changed from "5.4" to "9.8") CVSS metrics ("CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") CVSS temporal metrics ("CVSSv3 temporal score" set to "8.5") CVSSv3 score source (set to "CVE-2022-44640") Plugin Feed: 202301051823
Version 1.2 Nov 27, 2022, 11:49 PM New Plugin Feed: 202211272349