The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.

According to the version of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker     with permission to modify a principal entry could use     this flaw to cause kadmind to dereference a NULL     pointer and crash by supplying an empty DB argument to     the modify_principal command, if kadmind was configured     to use the LDAP KDB module. (CVE-2016-3119)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kerberos, a system for authenticating users and services on a network, was affected by several vulnerabilities. The Common Vulnerabilities and Exposures project identifies the following issues.

CVE-2013-1418 Kerberos allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request when multiple realms are configured.

CVE-2014-5351 Kerberos sends old keys in a response to a -randkey
-keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.

CVE-2014-5353 When the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.

CVE-2014-5355 Kerberos expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character,

CVE-2016-3119 Kerberos allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.

CVE-2016-3120 Kerberos allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.

For Debian 7 'Wheezy', these problems have been fixed in version 1.10.1+dfsg-5+deb7u9.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker     with permission to modify a principal entry could use     this flaw to cause kadmind to dereference a NULL     pointer and crash by supplying an empty DB argument to     the modify_principal command, if kadmind was configured     to use the LDAP KDB module. (CVE-2016-3119)

  - A NULL pointer dereference flaw was found in MIT     Kerberos krb5kdc service. An authenticated attacker     could use this flaw to cause krb5kdc to dereference a     NULL pointer and crash by making an S4U2Self request,     if the restrict_anonymous_to_tgt option was set to     true.(CVE-2016-3120)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a NULL pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module. (CVE-2016-3119)

A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a NULL pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true.
(CVE-2016-3120)

The following packages have been upgraded to a newer upstream version:
krb5 (1.14.1).

Security Fix(es) :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker with     permission to modify a principal entry could use this     flaw to cause kadmind to dereference a NULL pointer and     crash by supplying an empty DB argument to the     modify_principal command, if kadmind was configured to     use the LDAP KDB module. (CVE-2016-3119)

  - A NULL pointer dereference flaw was found in MIT     Kerberos krb5kdc service. An authenticated attacker     could use this flaw to cause krb5kdc to dereference a     NULL pointer and crash by making an S4U2Self request, if     the restrict_anonymous_to_tgt option was set to true.
    (CVE-2016-3120)

Additional Changes :

An update for krb5 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

The following packages have been upgraded to a newer upstream version:
krb5 (1.14.1). (BZ#1292153)

Security Fix(es) :

* A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a NULL pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module. (CVE-2016-3119)

* A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a NULL pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true.
(CVE-2016-3120)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

From Red Hat Security Advisory 2016:2591 :

An update for krb5 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

The following packages have been upgraded to a newer upstream version:
krb5 (1.14.1). (BZ#1292153)

Security Fix(es) :

* A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a NULL pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module. (CVE-2016-3119)

* A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a NULL pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true.
(CVE-2016-3120)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

This update for krb5 fixes the following security issue :

  - CVE-2016-3119: An authenticated attacker with permission     to modify a principal entry could have caused kadmind to     dereference a NULL pointer by supplying an empty DB     argument to the modify_principal command, if kadmind is     configured to use the LDAP KDB module. (bsc#971942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for krb5 fixes the following security issue :

  - CVE-2016-3119: An authenticated attacker with permission     to modify a principal entry could have caused kadmind to     dereference a NULL pointer by supplying an empty DB     argument to the modify_principal command, if kadmind is     configured to use the LDAP KDB module. (bsc#971942)

This update was imported from the SUSE:SLE-12:Update update project.

This update for krb5 fixes the following security issue :

  - CVE-2016-3119: An authenticated attacker with permission     to modify a principal entry could have caused kadmind to     dereference a NULL pointer by supplying an empty DB     argument to the modify_principal command, if kadmind is     configured to use the LDAP KDB module. (bsc#971942)

ID	Name	Product	Family	Severity
119067	EulerOS Virtualization 2.5.1 : krb5 (EulerOS-SA-2018-1376)	Nessus	Huawei Local Security Checks	medium
106536	Debian DLA-1265-1 : krb5 security update	Nessus	Debian Local Security Checks	medium
99836	EulerOS 2.0 SP1 : krb5 (EulerOS-SA-2016-1076)	Nessus	Huawei Local Security Checks	medium
97023	Amazon Linux AMI : krb5 (ALAS-2017-793)	Nessus	Amazon Linux Local Security Checks	medium
95842	Scientific Linux Security Update : krb5 on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	medium
95337	CentOS 7 : krb5 (CESA-2016:2591)	Nessus	CentOS Local Security Checks	medium
94712	Oracle Linux 7 : krb5 (ELSA-2016-2591)	Nessus	Oracle Linux Local Security Checks	medium
94554	RHEL 7 : krb5 (RHSA-2016:2591)	Nessus	Red Hat Local Security Checks	medium
90586	SUSE SLES11 Security Update : krb5 (SUSE-SU-2016:1088-1)	Nessus	SuSE Local Security Checks	medium
90564	openSUSE Security Update : krb5 (openSUSE-2016-474)	Nessus	SuSE Local Security Checks	medium
90506	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2016:0994-1)	Nessus	SuSE Local Security Checks	medium
90341	openSUSE Security Update : krb5 (openSUSE-2016-424)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2016-3119

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium