A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5828-1 advisory.

    It was discovered that Kerberos incorrectly handled certain S4U2Self requests. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 16.04 ESM and Ubuntu     18.04 LTS. (CVE-2018-20217)

    Greg Hudson discovered that Kerberos PAC implementation incorrectly handled certain parsing operations. A     remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code.
    (CVE-2022-42898)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2771 advisory.

    Several vulnerabilities were fixed in MIT Kerberos, a system for authenticating users and services on a     network. CVE-2018-5729 CVE-2018-5730 Fix flaws in LDAP DN checking. CVE-2018-20217 Ignore password     attributes for S4U2Self requests. CVE-2021-37750 Fix KDC null deref on TGS inner body null server. For     Debian 9 stretch, these problems have been fixed in version 1.15-1+deb9u3. We recommend that you upgrade     your krb5 packages. For the detailed security status of krb5 please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/krb5 Further information about Debian LTS security advisories,     how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has krb5 packages installed that are affected by a vulnerability:

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has krb5 packages installed that are affected by a vulnerability:

  - A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request. (CVE-2018-20217)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS-2020-1374 advisory.

    A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self request.(CVE-2018-20217)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Double free vulnerability in MIT Kerberos 5 (aka krb5)     allows attackers to have unspecified impact via vectors     involving automatic deletion of security contexts on     error.(CVE-2017-11462)

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the krb5 packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - Double free vulnerability in MIT Kerberos 5 (aka krb5)     allows attackers to have unspecified impact via vectors     involving automatic deletion of security contexts on     error.(CVE-2017-11462)

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A Reachable Assertion issue was discovered in the KDC     in MIT Kerberos 5 (aka krb5) before 1.17. If an     attacker can obtain a krbtgt ticket using an older     encryption type (single-DES, triple-DES, or RC4), the     attacker can crash the KDC by making an S4U2Self     request.(CVE-2018-20217)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the krb5 package has been released.

This update for krb5 fixes the following security issue :

  - CVE-2018-20217: Fixed an assertion issue with older     encryption types (bsc#1120489)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

krb5, a MIT Kerberos implementation, had several flaws in LDAP DN checking, which could be used to circumvent a DN containership check by supplying special parameters to some calls.

Further an attacker could crash the KDC by making S4U2Self requests.

For Debian 8 'Jessie', these problems have been fixed in version 1.12.1+dfsg-19+deb8u5.

We recommend that you upgrade your krb5 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for krb5 fixes the following issues :

Security issue fixed :

  - CVE-2018-20217: Fixed an assertion issue with older     encryption types (bsc#1120489)

This update was imported from the SUSE:SLE-15:Update update project.

This update for krb5 fixes the following issues :

Security issue fixed :

CVE-2018-20217: Fixed an assertion issue with older encryption types (bsc#1120489)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Improve memset hygiene in one location.

----

Fix low-severity CVE-2018-20217 (an authenticated user who can obtain a TGT using an older encryption type (DES, DES3, or RC4) can cause an assertion failure in the KDC by sending an S4U2Self request.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix low-severity CVE-2018-20217 (an authenticated user who can obtain a TGT using an older encryption type (DES, DES3, or RC4) can cause an assertion failure in the KDC by sending an S4U2Self request.)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
221991	Linux Distros Unpatched Vulnerability : CVE-2018-20217	Nessus	Misc.	medium
170651	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : Kerberos vulnerabilities (USN-5828-1)	Nessus	Ubuntu Local Security Checks	high
153808	Debian DLA-2771-1 : krb5 - LTS security update	Nessus	Debian Local Security Checks	medium
143936	NewStart CGSL CORE 5.05 / MAIN 5.05 : krb5 Vulnerability (NS-SA-2020-0103)	Nessus	NewStart CGSL Local Security Checks	medium
140697	NewStart CGSL CORE 5.04 / MAIN 5.04 : krb5 Vulnerability (NS-SA-2020-0040)	Nessus	NewStart CGSL Local Security Checks	medium
137097	Amazon Linux AMI : krb5 (ALAS-2020-1374)	Nessus	Amazon Linux Local Security Checks	medium
135629	EulerOS Virtualization 3.0.2.2 : krb5 (EulerOS-SA-2020-1467)	Nessus	Huawei Local Security Checks	critical
134481	EulerOS Virtualization for ARM 64 3.0.2.0 : krb5 (EulerOS-SA-2020-1192)	Nessus	Huawei Local Security Checks	critical
132135	EulerOS 2.0 SP3 : krb5 (EulerOS-SA-2019-2600)	Nessus	Huawei Local Security Checks	medium
131870	EulerOS 2.0 SP2 : krb5 (EulerOS-SA-2019-2378)	Nessus	Huawei Local Security Checks	medium
131806	EulerOS 2.0 SP5 : krb5 (EulerOS-SA-2019-2532)	Nessus	Huawei Local Security Checks	medium
126187	Photon OS 1.0: Krb5 PHSA-2019-1.0-0239	Nessus	PhotonOS Local Security Checks	medium
126183	Photon OS 3.0: Krb5 PHSA-2019-3.0-0020	Nessus	PhotonOS Local Security Checks	medium
126181	Photon OS 2.0: Krb5 PHSA-2019-2.0-0164	Nessus	PhotonOS Local Security Checks	medium
121412	openSUSE Security Update : krb5 (openSUSE-2019-85)	Nessus	SuSE Local Security Checks	medium
121399	Debian DLA-1643-1 : krb5 security update	Nessus	Debian Local Security Checks	medium
121287	openSUSE Security Update : krb5 (openSUSE-2019-63)	Nessus	SuSE Local Security Checks	medium
121243	SUSE SLES12 Security Update : krb5 (SUSE-SU-2019:0113-1)	Nessus	SuSE Local Security Checks	medium
121241	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2019:0111-1)	Nessus	SuSE Local Security Checks	medium
121083	Fedora 28 : krb5 (2019-ac7e19b0c8)	Nessus	Fedora Local Security Checks	medium
120564	Fedora 29 : krb5 (2018-7db7ccda4d)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2018-20217

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium