Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0 allows remote attackers to cause a denial of service (crash) via a crafted Kerberos message that triggers a heap-based buffer overflow in the component array.

From Red Hat Security Advisory 2006:0746 :

Updated mod_auth_kerb packages that fix a security flaw and a bug in multiple realm handling are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

mod_auth_kerb is module for the Apache HTTP Server designed to provide Kerberos authentication over HTTP.

An off by one flaw was found in the way mod_auth_kerb handles certain Kerberos authentication messages. A remote client could send a specially crafted authentication request which could crash an httpd child process (CVE-2006-5989).

A bug in the handling of multiple realms configured using the 'KrbAuthRealms' directive has also been fixed.

All users of mod_auth_kerb should upgrade to these updated packages, which contain backported patches that resolve these issues.

An off-by-one error leading to a heap-based buffer overflow has been identified in libapache-mod-auth-kerb, an Apache module for Kerberos authentication. The error could allow an attacker to trigger an application crash or potentially execute arbitrary code by sending a specially crafted kerberos message.

The remote host is affected by the vulnerability described in GLSA-200701-14 (Mod_auth_kerb: Denial of Service)

    Mod_auth_kerb improperly handles component byte encoding in the     der_get_oid() function, allowing for a buffer overflow to occur if     there are no components which require more than one byte for encoding.
  Impact :

    An attacker could try to access a Kerberos protected resource on an     Apache server with an incorrectly configured service principal and     crash the server process. It is important to note that this buffer     overflow is not known to allow for the execution of code.
  Workaround :

    There is no known workaround at this time.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2006:0746 advisory.

    mod_auth_kerb is module for the Apache HTTP Server designed to     provide Kerberos authentication over HTTP.

    An off by one flaw was found in the way mod_auth_kerb handles certain     Kerberos authentication messages. A remote client could send a specially     crafted authentication request which could crash an httpd child process     (CVE-2006-5989).

    A bug in the handling of multiple realms configured using the     KrbAuthRealms directive has also been fixed.

    All users of mod_auth_kerb should upgrade to these updated packages, which     contain backported patches that resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated mod_auth_kerb packages that fix a security flaw and a bug in multiple realm handling are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

mod_auth_kerb is module for the Apache HTTP Server designed to provide Kerberos authentication over HTTP.

An off by one flaw was found in the way mod_auth_kerb handles certain Kerberos authentication messages. A remote client could send a specially crafted authentication request which could crash an httpd child process (CVE-2006-5989).

A bug in the handling of multiple realms configured using the 'KrbAuthRealms' directive has also been fixed.

All users of mod_auth_kerb should upgrade to these updated packages, which contain backported patches that resolve these issues.

The remote host is running the Apache mod_auth_kerb Kerberos authentication module.  This version of mod_auth_kerb is reported to be vulnerable to a remote buffer overflow.  The details of the attack are not yet known, however, it is alleged that an attacker would be able to crash the system or execute arbitrary code.  In order to exploit this flaw, an attacker would only need to send a malformed Kerberos authentication request. 

ID	Name	Product	Family	Severity
67427	Oracle Linux 4 : mod_auth_kerb (ELSA-2006-0746)	Nessus	Oracle Linux Local Security Checks	medium
25225	Debian DSA-1247-1 : libapache-mod-auth-kerb - heap overflow	Nessus	Debian Local Security Checks	medium
24250	GLSA-200701-14 : Mod_auth_kerb: Denial of Service	Nessus	Gentoo Local Security Checks	medium
23797	RHEL 4 : mod_auth_kerb (RHSA-2006:0746)	Nessus	Red Hat Local Security Checks	high
23788	CentOS 4 : mod_auth_kerb (CESA-2006:0746)	Nessus	CentOS Local Security Checks	medium
3816	Apache mod_auth_kerb <= 5.20 Buffer Overflow	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2006-5989

high

Tenable Plugins

medium

medium

medium

high

medium

medium