SuSE 11.1 Security Update : Kerberos 5 (SAT Patch Number 5594)

critical Nessus Plugin ID 57430

Synopsis

The remote SuSE 11 host is missing one or more security updates.

Description

This update of krb5 fixes two security issues.

- A remote code execution in the kerberized telnet daemon was fixed. (This only affects the ktelnetd from the krb5-appl RPM, not the regular telnetd supplied by SUSE.). (CVE-2011-4862)

- / MITKRB5-SA-2011-005: Fixed krb5 ftpd unauthorized file access problems. (CVE-2011-1526)

Solution

Apply SAT patch number 5594.

See Also

https://bugzilla.novell.com/show_bug.cgi?id=698471

https://bugzilla.novell.com/show_bug.cgi?id=738632

http://support.novell.com/security/cve/CVE-2011-1526.html

http://support.novell.com/security/cve/CVE-2011-4862.html

Plugin Details

Severity: Critical

ID: 57430

File Name: suse_11_krb5-111229.nasl

Version: 1.17

Type: local

Agent: unix

Published: 1/3/2012

Updated: 1/19/2021

Supported Sensors: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Critical

Score: 9.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:novell:suse_linux:11:krb5, p-cpe:/a:novell:suse_linux:11:krb5-32bit, p-cpe:/a:novell:suse_linux:11:krb5-apps-clients, p-cpe:/a:novell:suse_linux:11:krb5-apps-servers, p-cpe:/a:novell:suse_linux:11:krb5-client, p-cpe:/a:novell:suse_linux:11:krb5-server, cpe:/o:novell:suse_linux:11

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/29/2011

Exploitable With

Core Impact

Metasploit (Linux BSD-derived Telnet Service Encryption Key ID Buffer Overflow)

ExploitHub (EH-11-760)

Reference Information

CVE: CVE-2011-1526, CVE-2011-4862