EulerOS 2.0 SP12 : krb5 (EulerOS-SA-2026-3271)

medium Nessus Plugin ID 343741

Synopsis

The remote EulerOS host is missing a security update.

Description

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read.
The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len 2, triggering the underflow when the KDC or kadmind reads principal data.(CVE-2026-11850)

Tenable has extracted the preceding description block directly from the EulerOS krb5 security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected krb5 packages.

Plugin Details

Severity: Medium

ID: 343741

File Name: EulerOS_SA-2026-3271.nasl

Version: 1.1

Type: Local

Family: Huawei Local Security Checks

Published: 9/8/2026

Updated: 9/8/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 51.64

CVSS v2

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 4.6

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:N/A:C

CVSS Score Source: CVE-2026-11850

CVSS v3

Risk Factor: Medium

Base Score: 5

Temporal Score: 4.4

Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:krb5-client, p-cpe:/a:huawei:euleros:krb5-devel, p-cpe:/a:huawei:euleros:krb5-help, p-cpe:/a:huawei:euleros:krb5-libs, p-cpe:/a:huawei:euleros:krb5-server, p-cpe:/a:huawei:euleros:krb5

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Exploit Ease: No known exploits are available

Patch Publication Date: 9/8/2026

Vulnerability Publication Date: 6/11/2026

Reference Information

CVE: CVE-2026-11850

Detections

Analytics