Mandriva Linux Security Advisory : krb5 (MDVSA-2008:069)

This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.


Synopsis :

The remote Mandriva Linux host is missing one or more security
updates.

Description :

Multiple memory management flaws were found in the GSSAPI library used
by Kerberos that could result in the use of already freed memory or an
attempt to free already freed memory, possibly leading to a crash or
allowing the execution of arbitrary code (CVE-2007-5901,
CVE-2007-5971).

A flaw was discovered in how the Kerberos krb5kdc handled Kerberos v4
protocol packets. An unauthenticated remote attacker could use this
flaw to crash the krb5kdc daemon, disclose portions of its memory, or
possibly %execute arbitrary code using malformed or truncated Kerberos
v4 protocol requests (CVE-2008-0062, CVE-2008-0063).

This issue only affects krb5kdc when it has Kerberos v4 protocol
compatibility enabled, which is a compiled-in default in all Kerberos
versions that Mandriva Linux ships prior to Mandriva Linux 2008.0.
Kerberos v4 protocol support can be disabled by adding v4_mode=none
(without quotes) to the [kdcdefaults] section of
/etc/kerberos/krb5kdc/kdc.conf.

A flaw in the RPC library as used in Kerberos' kadmind was discovered
by Jeff Altman of Secure Endpoints. An unauthenticated remote attacker
could use this vulnerability to crash kadmind or possibly execute
arbitrary code in systems with certain resource limits configured;
this does not affect the default resource limits used by Mandriva
Linux (CVE-2008-0947).

The updated packages have been patched to correct these issues.

See also :

http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-001.txt
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-002.txt

Solution :

Update the affected packages.

Risk factor :

Critical / CVSS Base Score : 10.0
(CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C)

Family: Mandriva Local Security Checks

Nessus Plugin ID: 38056 (mandriva_MDVSA-2008-069.nasl)

Bugtraq ID:

CVE ID: CVE-2007-5901
CVE-2007-5971
CVE-2008-0062
CVE-2008-0063
CVE-2008-0947

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now