Detections
Analytics
RHEL 4 : krb5 (RHSA-2009:0409)
critical Nessus Plugin ID 36113
Synopsis
The remote Red Hat host is missing one or more security updates.Description
Updated krb5 packages that fix a security issue are now available for Red Hat Enterprise Linux 4.This update has been rated as having important security impact by the Red Hat Security Response Team.
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).
An input validation flaw was found in the ASN.1 (Abstract Syntax Notation One) decoder used by MIT Kerberos. A remote attacker could use this flaw to crash a network service using the MIT Kerberos library, such as kadmind or krb5kdc, by causing it to dereference or free an uninitialized pointer. (CVE-2009-0846)
All krb5 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running services using the MIT Kerberos libraries must be restarted for the update to take effect.
Solution
Update the affected packages.See Also
https://access.redhat.com/security/cve/cve-2009-0846
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-002.txt
Plugin Details
Severity: Critical
ID: 36113
File Name: redhat-RHSA-2009-0409.nasl
Version: 1.24
Type: local
Agent: unix
Family: Red Hat Local Security Checks
Published: 4/8/2009
Updated: 1/14/2021
Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:redhat:enterprise_linux:krb5-devel, p-cpe:/a:redhat:enterprise_linux:krb5-libs, p-cpe:/a:redhat:enterprise_linux:krb5-server, p-cpe:/a:redhat:enterprise_linux:krb5-workstation, cpe:/o:redhat:enterprise_linux:4, cpe:/o:redhat:enterprise_linux:4.7
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Patch Publication Date: 4/7/2009
Vulnerability Publication Date: 3/27/2009
Reference Information
CVE: CVE-2009-0844, CVE-2009-0845, CVE-2009-0846, CVE-2009-0847