Bugs have been fixed in the krb5_aname_to_localname library function.
Specifically, buffer overflows were possible for all Kerberos versions up to and including 1.3.3. The krb5_aname_to_localname function translates a Kerberos principal name to a local account name, typically a UNIX username. This function is frequently used when performing authorization checks.

If configured with mappings from particular Kerberos principals to particular UNIX user names, certain functions called by krb5_aname_to_localname will not properly check the lengths of buffers used to store portions of the principal name. If configured to map principals to user names using rules, krb5_aname_to_localname would consistently write one byte past the end of a buffer allocated from the heap. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0523 to this issue.

Only configurations which enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname() are vulnerable.
These configurations are not the default.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200406-21 (mit-krb5: Multiple buffer overflows in krb5_aname_to_localname)

    The library function krb5_aname_to_localname() contains multiple buffer     overflows. This is only exploitable if explicit mapping or rules-based     mapping is enabled. These are not enabled as default.
    With explicit mapping enabled, an attacker must authenticate using a     principal name listed in the explicit mapping list.
    With rules-based mapping enabled, an attacker must first be able to create     arbitrary principal names either in the local realm Kerberos realm or in a     remote realm from which the local realm's service are reachable by     cross-realm authentication.
  Impact :

    An attacker could use these vulnerabilities to execute arbitrary code with     the permissions of the user running mit-krb5, which could be the root user.
  Workaround :

    There is no known workaround at this time. All users are encouraged to     upgrade to the latest available version.

Updated Kerberos 5 (krb5) packages which correct buffer overflows in the krb5_aname_to_localname function are now available.

Kerberos is a network authentication system.

Bugs have been fixed in the krb5_aname_to_localname library function.
Specifically, buffer overflows were possible for all Kerberos versions up to and including 1.3.3. The krb5_aname_to_localname function translates a Kerberos principal name to a local account name, typically a UNIX username. This function is frequently used when performing authorization checks.

If configured with mappings from particular Kerberos principals to particular UNIX user names, certain functions called by krb5_aname_to_localname will not properly check the lengths of buffers used to store portions of the principal name. If configured to map principals to user names using rules, krb5_aname_to_localname would consistently write one byte past the end of a buffer allocated from the heap. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0523 to this issue.

Only configurations which enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname() are vulnerable.
These configurations are not the default.

Users of Kerberos are advised to upgrade to these erratum packages which contain backported security patches to correct these issues.

SEAM 1.0 Jumbo patch for Solaris 2.7_x86.
Date this patch was last updated by Sun : Oct/03/05

SunOS 5.9: krb5, gss patch.
Date this patch was last updated by Sun : Sep/14/10

SunOS 5.9_x86: krb5, gss patch.
Date this patch was last updated by Sun : Sep/14/10

Multiple buffer overflows exist in the krb5_aname_to_localname() library function that if exploited could lead to unauthorized root privileges. In order to exploit this flaw, an attacker must first successfully authenticate to a vulnerable service, which must be configured to enable the explicit mapping or rules-based mapping functionality of krb5_aname_to_localname, which is not a default configuration.

Mandrakesoft encourages all users to upgrade to these patched krb5 packages.

Update :

The original patch provided contained a bug where rule-based entries on systems without HAVE_REGCOMP would not work. These updated packages provide the second patch provided by Kerberos development team which fixes that behaviour.

In their advisory MITKRB5-SA-2004-001, the MIT Kerberos announced the existence of buffer overflow vulnerabilities in the krb5_aname_to_localname function. This function is only used if aname_to_localname is enabled in the configuration (this is not enabled by default).

SEAM 1.0 Jumbo patch for Solaris 2.7.
Date this patch was last updated by Sun : Oct/03/05

The remote host is missing Security Update 2004-09-07.  This security update fixes the following components :

  - CoreFoundation
  - IPSec
  - Kerberos
  - libpcap
  - lukemftpd
  - NetworkConfig
  - OpenLDAP
  - OpenSSH
  - PPPDialer
  - rsync
  - Safari
  - tcpdump

These applications contain multiple vulnerabilities that may allow a remote attacker to execute arbitrary code.

The remote host is missing Apple's Security Update 2004-09-07. This security update fixes the following components: CoreFoundation, IPSec, Kerberos, libpcap, lukemftpd, NetworkConfig, OpenLDAP, OpenSSH, PPPDialer, rsync, Safari and tcpdump

ID	Name	Product	Family	Published	Updated	Severity
13710	Fedora Core 1 : krb5-1.3.3-6 (2004-149)	Nessus	Fedora Local Security Checks	7/23/2004	1/11/2021	critical
14532	GLSA-200406-21 : mit-krb5: Multiple buffer overflows in krb5_aname_to_localname	Nessus	Gentoo Local Security Checks	8/30/2004	1/6/2021	critical
12502	RHEL 2.1 / 3 : krb5 (RHSA-2004:236)	Nessus	Red Hat Local Security Checks	7/6/2004	1/14/2021	critical
13711	Fedora Core 2 : krb5-1.3.3-7 (2004-150)	Nessus	Fedora Local Security Checks	7/23/2004	1/11/2021	critical
23294	Solaris 7 (x86) : 112537-06	Nessus	Solaris Local Security Checks	11/6/2006	1/14/2021	critical
13520	Solaris 9 (sparc) : 112908-38	Nessus	Solaris Local Security Checks	7/12/2004	1/14/2021	critical
13620	Solaris 9 (x86) : 115168-24	Nessus	Solaris Local Security Checks	7/12/2004	1/14/2021	critical
14155	Mandrake Linux Security Advisory : krb5 (MDKSA-2004:056-1)	Nessus	Mandriva Local Security Checks	7/31/2004	1/6/2021	critical
15357	Debian DSA-520-1 : krb5 - buffer overflows	Nessus	Debian Local Security Checks	9/29/2004	1/4/2021	critical
23248	Solaris 7 (sparc) : 112536-06	Nessus	Solaris Local Security Checks	11/6/2006	1/14/2021	critical
14676	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus	MacOS X Local Security Checks	9/8/2004	5/28/2024	high
2274	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Nessus Network Monitor	Web Clients	9/9/2004	3/6/2019	medium
800802	Mac OS X Multiple Vulnerabilities (Security Update 2004-09-07)	Log Correlation Engine	Operating System Detection			high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

high

medium

high