a. Service Console package krb5 update

   Kerberos is a network authentication protocol. It is designed to    provide strong authentication for client/server applications by    using secret-key cryptography.

   An input validation flaw in the asn1_decode_generaltime function in    MIT Kerberos 5 before 1.6.4 allows remote attackers to cause a    denial of service or possibly execute arbitrary code via vectors    involving an invalid DER encoding that triggers a free of an    uninitialized pointer.

   A remote attacker could use this flaw to crash a network service    using the MIT Kerberos library, such as kadmind or krb5kdc, by    causing it to dereference or free an uninitialized pointer or,    possibly, execute arbitrary code with the privileges of the user    running the service.

   NOTE: ESX by default is unaffected by this issue, the daemons    kadmind and krb5kdc are not installed in ESX.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2009-0846 to this issue.

   In addition the ESX 4.0 Service Console krb5 package was also    updated for CVE-2009-0845, and CVE-2009-0844 and RHBA-2009-0135.

   MIT Kerberos versions 5 1.5 through 1.6.3 might allow remote    attackers to cause a denial of service by using invalid    ContextFlags data in the reqFlags field in a negTokenInit token.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0845 to this issue.

   MIT Kerberos 5 before version 1.6.4 might allow remote attackers to    cause a denial of service or possibly execute arbitrary code by    using vectors involving an invalid DER encoding that triggers a    free of an uninitialized pointer.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0846 to this issue.

   For ESX 4.0, 3.5, 3.0.3 the Service Console package pam_krb5 has    also been upgraded.  For details on the non-security issues that    this upgrade addresses, refer to the respective KB article listed    in section 4 below.

s700_800 11.23 KRB5-Client Version 1.0 Cumulative patch : 

Potential security vulnerabilities have been identified on HP-UX running Kerberos. These vulnerabilities could be exploited by remote unauthenticated users to create a Denial of Service (DoS) or to execute arbitrary code.

s700_800 11.31 KRB5-Client Version 1.3.5.03 Cumulative patch : 

Potential security vulnerabilities have been identified on HP-UX running Kerberos. These vulnerabilities could be exploited by remote unauthenticated users to create a Denial of Service (DoS) or to execute arbitrary code.

s700_800 11.11 KRB5-Client Version 1.0 cumulative patch : 

Potential security vulnerabilities have been identified on HP-UX running Kerberos. These vulnerabilities could be exploited by remote unauthenticated users to create a Denial of Service (DoS) or to execute arbitrary code.

Updated krb5 packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

An input validation flaw was found in the ASN.1 (Abstract Syntax Notation One) decoder used by MIT Kerberos. A remote attacker could use this flaw to crash a network service using the MIT Kerberos library, such as kadmind or krb5kdc, by causing it to dereference or free an uninitialized pointer. (CVE-2009-0846)

All krb5 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running services using the MIT Kerberos libraries must be restarted for the update to take effect.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.7.  Mac OS X 10.5.7 contains security fixes for the following products : 

- Apache
- ATS
- BIND
- CFNetwork
- CoreGraphics
-Cscope
- CUPS
- Disk Images
- enscript
- Flash player
- Help Viewer
- iChat
- Internation Components for Unicode
- IPSec
- Kerberos
- Kernel
- Launch Services
- libxml
- Net-SNMP
- Network Time
- Networking
- OpenSSL
- PHP
- QuickDraw Manager
- ruby
- Safari
- Spotlight
- system_cmds
- telnet
- WebKit
- X11
- Terminal

ID	Name	Product	Family	Published	Updated	Severity
40393	VMSA-2009-0008 : ESX Service Console update for krb5	Nessus	VMware ESX Local Security Checks	7/27/2009	1/6/2021	critical
41976	HP-UX PHSS_39765 : HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code (HPSBUX02421 SSRT090047 rev.2)	Nessus	HP-UX Local Security Checks	10/5/2009	1/11/2021	critical
41977	HP-UX PHSS_39766 : HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code (HPSBUX02421 SSRT090047 rev.2)	Nessus	HP-UX Local Security Checks	10/5/2009	1/11/2021	critical
41978	HP-UX PHSS_39774 : HP-UX Running Kerberos, Remote Denial of Service (DoS), Execution of Arbitrary Code (HPSBUX02421 SSRT090047 rev.2)	Nessus	HP-UX Local Security Checks	10/5/2009	1/11/2021	critical
43740	CentOS 4 : krb5 (CESA-2009:0409)	Nessus	CentOS Local Security Checks	1/6/2010	1/4/2021	critical
5023	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Nessus Network Monitor	Generic	8/18/2004	3/6/2019	critical
800792	Mac OS X 10.5 < 10.5.7 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection			high

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

high