The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1389 advisory.

    - incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345, #1128157)
    - gssapi: pull in upstream fix for a possible NULL dereference in spnego       (CVE-2014-4344, #1121510)
    - gssapi: pull in proposed-and-accepted fix for a double free in initiators       (David Woodhouse, CVE-2014-4343, #1121510)
    - correct a type mistake in the backported fix for CVE-2013-1418/CVE-2013-6800
    - pull in backported fix for denial of service by injection of malformed       GSSAPI tokens (CVE-2014-4341, CVE-2014-4342, #1121510)
    - incorporate backported patch for remote crash of KDCs which serve multiple       realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800, more of

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Oracle Linux 6 : krb5 (ELSA-2014-1389)

critical Nessus Plugin ID 78523

Version 1.12