The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug     by adding != 0 comparisons to the result of memcmp. When these patches were backported to the     heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in     causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue,
    where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be
    opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by
    forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute
    delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD
    DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the
    not-delegated flag set. (CVE-2019-14870)

  - A null pointer de-reference was found in the way samba kerberos server handled missing sname in TGS-REQ
    (Ticket Granting Server - Request). An authenticated user could use this flaw to crash the samba server.
    (CVE-2021-3671)

  - Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a
    preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept. (CVE-2021-44758)

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and
    unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI
    library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a
    maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the
    application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug
    by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the
    heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in
    causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142)

The version of heimdal installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-45142 advisory.

  - The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug     by adding != 0 comparisons to the result of memcmp. When these patches were backported to the     heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in     causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202310-06 (Heimdal: Multiple Vulnerabilities)

  - All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue,     where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be     opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authentication, by     forcing all tickets for these clients to be non-forwardable. In AD this is implemented by a user attribute     delegation_not_allowed (aka not-delegated), which translates to disallow-forwardable. However the Samba AD     DC does not do that for S4U2Self and does set the forwardable flag even if the impersonated client has the     not-delegated flag set. (CVE-2019-14870)

  - Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a     preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept. (CVE-2021-44758)

  - A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and     unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI     library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a     maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the     application, possibly resulting in a denial of service (DoS) attack. (CVE-2022-3437)

  - A vulnerability classified as critical was found in SourceCodester eLearning System 1.0. This     vulnerability affects unknown code of the file /admin/students/manage.php. The manipulation of the     argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed     to the public and may be used. VDB-212014 is the identifier assigned to this vulnerability.
    (CVE-2022-3671)

  - Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a     denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via     PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users     should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue. (CVE-2022-41916)

  - PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that     may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit     platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other     platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has a similar bug.
    (CVE-2022-42898)

  - Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the     ASN.1 codec used by the Key Distribution Center (KDC). (CVE-2022-44640)

  - The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug     by adding != 0 comparisons to the result of memcmp. When these patches were backported to the     heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in     causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142)

  -  Please review the referenced CVE identifiers for details.  (CVE-2022-44758)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of heimdal installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-45142 advisory.

  - The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug     by adding != 0 comparisons to the result of memcmp. When these patches were backported to the     heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in     causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5344 advisory.

    Helmut Grohne discovered a flaw in Heimdal, an implementation of Kerberos 5 that aims to be compatible     with MIT Kerberos. The backports of fixes for CVE-2022-3437 accidentally inverted important memory     comparisons in the arcfour-hmac-md5 and rc4-hmac integrity check handlers for gssapi, resulting in     incorrect validation of message integrity codes. For the stable distribution (bullseye), this problem has     been fixed in version 7.7.0+dfsg-2+deb11u3. We recommend that you upgrade your heimdal packages. For the     detailed security status of heimdal please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/heimdal

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3311 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3311-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                        Helmut Grohne     February 08, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : heimdal     Version        : 7.5.0+dfsg-3+deb10u2     CVE ID         : CVE-2022-45142     Debian Bug     : #1030849

    I discovered a flaw in Heimdal, an implementation of Kerberos 5 that     aims to be compatible with MIT Kerberos. The backports of fixes for     CVE-2022-3437 accidentally inverted important memory comparisons in the     arcfour-hmac-md5 and rc4-hmac integrity check handlers for gssapi,     resulting in incorrect validation of message integrity codes.

    For Debian 10 buster, this problem has been fixed in version     7.5.0+dfsg-3+deb10u2.

    We recommend that you upgrade your heimdal packages.

    For the detailed security status of heimdal please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/heimdal

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5849-1 advisory.

    Helmut Grohne discovered that Heimdal GSSAPI incorrectly handled logical conditions that are related to     memory management operations. An attacker could possibly use this issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255526	Linux Distros Unpatched Vulnerability : CVE-2022-45142	Nessus	Misc.	high
423997	Alpine: multiple heimdal packages: security update to 7.7.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
423997	Alpine: multiple heimdal packages: security update to 7.7.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
423996	Alpine: multiple heimdal packages: security update to 7.8.0-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423996	Alpine: multiple heimdal packages: security update to 7.8.0-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
233495	Azure Linux 3.0 Security Update: heimdal (CVE-2022-45142)	Nessus	Azure Linux Local Security Checks	high
404882	Alpine: heimdal: security update to 7.8.0-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404882	Alpine: heimdal: security update to 7.8.0-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
404880	Alpine: heimdal: security update to 7.7.1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
404880	Alpine: heimdal: security update to 7.7.1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
182758	GLSA-202310-06 : Heimdal: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
173540	CBL Mariner 2.0 Security Update: heimdal (CVE-2022-45142)	Nessus	MarinerOS Local Security Checks	high
400046	Alpine: multiple heimdal packages: security update to 7.8.0-r1 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400046	Alpine: multiple heimdal packages: security update to 7.8.0-r1 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
171237	Debian DSA-5344-1 : heimdal - security update	Nessus	Debian Local Security Checks	high
171215	Debian dla-3311 : heimdal-clients - security update	Nessus	Debian Local Security Checks	high
171212	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : Heimdal vulnerabilities (USN-5849-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2022-45142

high

Tenable Plugins

high

critical

critical

high

high

high

high

high

high

high

critical

high

high

high

high

high

high