This script is Copyright (C) 2004-2015 Tenable Network Security, Inc.
The remote Gentoo host is missing one or more security-related
The remote host is affected by the vulnerability described in GLSA-200409-09
(MIT krb5: Multiple vulnerabilities)
The implementation of the Key Distribution Center (KDC) and the MIT krb5
library contain double-free vulnerabilities, making client programs as well
as application servers vulnerable.
The ASN.1 decoder library is vulnerable to a denial of service attack,
including the KDC.
The double-free vulnerabilities could allow an attacker to execute
arbitrary code on a KDC host and hosts running krb524d or vulnerable
services. In the case of a KDC host, this can lead to a compromise of the
entire Kerberos realm. Furthermore, an attacker impersonating a legitimate
KDC or application server can potentially execute arbitrary code on
An attacker can cause a denial of service for a KDC or application server
and clients, the latter if impersonating a legitimate KDC or application
There is no known workaround at this time.
See also :
All mit-krb5 users should upgrade to the latest stable version:
# emerge sync
# emerge -pv '>=app-crypt/mit-krb5-1.3.4'
# emerge '>=app-crypt/mit-krb5-1.3.4'
Risk factor :
High / CVSS Base Score : 7.5
Family: Gentoo Local Security Checks
Nessus Plugin ID: 14666 (gentoo_GLSA-200409-09.nasl)
CVE ID: CVE-2004-0642CVE-2004-0643CVE-2004-0644CVE-2004-0772
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.