A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS / 22.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5828-1 advisory.

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2771 advisory.

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

  - MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos     database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by     supplying tagged data that is internal to the database module. (CVE-2018-5729)

  - MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos     database to circumvent a DN containership check by supplying both a linkdn and containerdn database     argument, or by supplying a DN string which is a left extension of a container DN string but is not     hierarchically within the container DN. (CVE-2018-5730)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has     a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
    (CVE-2021-37750)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has krb5 packages installed that are affected by a vulnerability:

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has krb5 packages installed that are affected by a vulnerability:

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.(CVE-2018-20217)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Double free vulnerability in MIT Kerberos 5 (aka krb5)     allows attackers to have unspecified impact via vectors     involving automatic deletion of security contexts on     error.(CVE-2017-11462)

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the krb5 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Double free vulnerability in MIT Kerberos 5 (aka krb5)     allows attackers to have unspecified impact via vectors     involving automatic deletion of security contexts on     error.(CVE-2017-11462)

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the krb5 package has been released.

This update for krb5 fixes the following security issue :

  - CVE-2018-20217: Fixed an assertion issue with older     encryption types (bsc#1120489)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

krb5, a MIT Kerberos implementation, had several flaws in LDAP DN checking, which could be used to circumvent a DN containership check by supplying special parameters to some calls.

Further an attacker could crash the KDC by making S4U2Self requests.

For Debian 8 'Jessie', these problems have been fixed in version 1.12.1+dfsg-19+deb8u5.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for krb5 fixes the following issues :

Security issue fixed :

  - CVE-2018-20217: Fixed an assertion issue with older     encryption types (bsc#1120489)

This update was imported from the SUSE:SLE-15:Update update project.

This update for krb5 fixes the following issues :

Security issue fixed :

CVE-2018-20217: Fixed an assertion issue with older encryption types (bsc#1120489)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Improve memset hygiene in one location.

----

Fix low-severity CVE-2018-20217 (an authenticated user who can obtain a TGT using an older encryption type (DES, DES3, or RC4) can cause an assertion failure in the KDC by sending an S4U2Self request.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix low-severity CVE-2018-20217 (an authenticated user who can obtain a TGT using an older encryption type (DES, DES3, or RC4) can cause an assertion failure in the KDC by sending an S4U2Self request.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
170651	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Kerberos vulnerabilities (USN-5828-1)	Nessus	Ubuntu Local Security Checks	high
153808	Debian DLA-2771-1 : krb5 - LTS security update	Nessus	Debian Local Security Checks	medium
143936	NewStart CGSL CORE 5.05 / MAIN 5.05 : krb5 Vulnerability (NS-SA-2020-0103)	Nessus	NewStart CGSL Local Security Checks	medium
140697	NewStart CGSL CORE 5.04 / MAIN 5.04 : krb5 Vulnerability (NS-SA-2020-0040)	Nessus	NewStart CGSL Local Security Checks	medium
137097	Amazon Linux AMI : krb5 (ALAS-2020-1374)	Nessus	Amazon Linux Local Security Checks	medium
135629	EulerOS Virtualization 3.0.2.2 : krb5 (EulerOS-SA-2020-1467)	Nessus	Huawei Local Security Checks	critical
134481	EulerOS Virtualization for ARM 64 3.0.2.0 : krb5 (EulerOS-SA-2020-1192)	Nessus	Huawei Local Security Checks	critical
132135	EulerOS 2.0 SP3 : krb5 (EulerOS-SA-2019-2600)	Nessus	Huawei Local Security Checks	medium
131870	EulerOS 2.0 SP2 : krb5 (EulerOS-SA-2019-2378)	Nessus	Huawei Local Security Checks	medium
131806	EulerOS 2.0 SP5 : krb5 (EulerOS-SA-2019-2532)	Nessus	Huawei Local Security Checks	medium
126187	Photon OS 1.0: Krb5 PHSA-2019-1.0-0239	Nessus	PhotonOS Local Security Checks	medium
126183	Photon OS 3.0: Krb5 PHSA-2019-3.0-0020	Nessus	PhotonOS Local Security Checks	medium
126181	Photon OS 2.0: Krb5 PHSA-2019-2.0-0164	Nessus	PhotonOS Local Security Checks	medium
121412	openSUSE Security Update : krb5 (openSUSE-2019-85)	Nessus	SuSE Local Security Checks	medium
121399	Debian DLA-1643-1 : krb5 security update	Nessus	Debian Local Security Checks	medium
121287	openSUSE Security Update : krb5 (openSUSE-2019-63)	Nessus	SuSE Local Security Checks	medium
121243	SUSE SLES12 Security Update : krb5 (SUSE-SU-2019:0113-1)	Nessus	SuSE Local Security Checks	medium
121241	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2019:0111-1)	Nessus	SuSE Local Security Checks	medium
121083	Fedora 28 : krb5 (2019-ac7e19b0c8)	Nessus	Fedora Local Security Checks	medium
120564	Fedora 29 : krb5 (2018-7db7ccda4d)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-20217

medium

Tenable Plugins

high

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium