Various return checks of setuid() and seteuid() calls have been fixed in kerberos client and server applications.

If these applications are setuid, it might have been possible for local attackers to gain root access. (CVE-2006-3083)

We are not affected by the seteuid() problems, tracked by CVE-2006-3084.

The remote host is affected by the vulnerability described in GLSA-200608-15 (MIT Kerberos 5: Multiple local privilege escalation vulnerabilities)

    Unchecked calls to setuid() in krshd and v4rcp, as well as unchecked     calls to seteuid() in kftpd and in ksu, have been found in the MIT     Kerberos 5 program suite and may lead to a local root privilege     escalation.
  Impact :

    A local attacker could exploit this vulnerability to execute arbitrary     code with elevated privileges.
  Workaround :

    There is no known workaround at this time.

In certain application programs packaged in the MIT Kerberos 5 source distribution, calls to setuid() and seteuid() are not always checked for success and may fail with some PAM configurations. A local user could exploit one of these vulnerabilities to result in privilege escalation. No exploit code is known to exist at this time.

A flaw was discovered in some bundled Kerberos-aware packages that would fail to check the results of the setuid() call. This call can fail in some circumstances on the Linux 2.6 kernel if certain user limits are reached, which could be abused by a local attacker to get the applications to continue to run as root, possibly leading to an elevation of privilege.

Updated packages have been patched to correct this issue.

Updated krb5 packages are now available for Red Hat Enterprise Linux 4 to correct a privilege escalation security flaw.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC.

A flaw was found where some bundled Kerberos-aware applications would fail to check the result of the setuid() call. On Linux 2.6 kernels, the setuid() call can fail if certain user limits are hit. A local attacker could manipulate their environment in such a way to get the applications to continue to run as root, potentially leading to an escalation of privileges. (CVE-2006-3083).

Users are advised to update to these erratum packages which contain a backported fix to correct this issue.

Various return checks of setuid() and seteuid() calls have been fixed in kerberos client and server applications.

If these applications are setuid, it might have been possible for local attackers to gain root access (CVE-2006-3083).

We are not affected by the seteuid() problems, tracked by CVE-2006-3084.

Michael Calmer and Marcus Meissner discovered that several krb5 tools did not check the return values from setuid() system calls. On systems that have configured user process limits, it may be possible for an attacker to cause setuid() to fail via resource starvation. In that situation, the tools will not reduce their privilege levels, and will continue operation as the root user.

By default, Ubuntu does not ship with user process limits.

Please note that these packages are not officially supported by Ubuntu (they are in the 'universe' component of the archive).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200608-21 (Heimdal: Multiple local privilege escalation vulnerabilities)

    The ftpd and rcp applications provided by Heimdal fail to check the     return value of calls to seteuid().
  Impact :

    A local attacker could exploit this vulnerability to execute arbitrary     code with elevated privileges.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Published	Updated	Severity
29496	SuSE 10 Security Update : krb5-apps-servers and krb5-apps-clients (ZYPP Patch Number 1938)	Nessus	SuSE Local Security Checks	12/13/2007	1/14/2021	high
22214	GLSA-200608-15 : MIT Kerberos 5: Multiple local privilege escalation vulnerabilities	Nessus	Gentoo Local Security Checks	8/14/2006	1/6/2021	high
22688	Debian DSA-1146-1 : krb5 - programming error	Nessus	Debian Local Security Checks	10/14/2006	1/4/2021	high
23888	Mandrake Linux Security Advisory : krb5 (MDKSA-2006:139)	Nessus	Mandriva Local Security Checks	12/16/2006	1/6/2021	high
22201	RHEL 4 : krb5 (RHSA-2006:0612)	Nessus	Red Hat Local Security Checks	8/10/2006	1/14/2021	high
27312	openSUSE 10 Security Update : krb5-apps-clients (krb5-apps-clients-1937)	Nessus	SuSE Local Security Checks	10/17/2007	1/14/2021	high
27913	Ubuntu 5.04 / 5.10 / 6.06 LTS : krb5 vulnerabilities (USN-334-1)	Nessus	Ubuntu Local Security Checks	11/10/2007	1/19/2021	high
22197	CentOS 4 : krb5 (CESA-2006:0612)	Nessus	CentOS Local Security Checks	8/10/2006	1/4/2021	high
22283	GLSA-200608-21 : Heimdal: Multiple local privilege escalation vulnerabilities	Nessus	Gentoo Local Security Checks	8/30/2006	1/6/2021	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high