EulerOS 2.0 SP3 : krb5 (EulerOS-SA-2018-1398)
High Nessus Plugin ID 119526
SynopsisThe remote EulerOS host is missing multiple security updates.
DescriptionAccording to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :
- null dereference in kadmind or DN container check bypass by supplying special crafted data (CVE-2018-5729)
- DN container check bypass by supplying special crafted data (CVE-2018-5730)
- A stack based buffer overflow was found in the get_matching_data() function, when reading the principal's certificate during pkinit preauthentication. If the Certifcate Authority's subject line is sufficiently long, an attacker able to have a specially crafted certificate signed could crash the authentication process, such as kinit, or, possibly, run arbitrary code.(CVE-2017-15088 )
Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
SolutionUpdate the affected krb5 packages.