The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0925 advisory.

    Kerberos is a network authentication system which allows clients and     servers to authenticate to each other using symmetric encryption and a     trusted third party, the Key Distribution Center (KDC).

    Multiple checksum validation flaws were discovered in the MIT Kerberos     implementation. A remote attacker could use these flaws to tamper with     certain Kerberos protocol packets and, possibly, bypass authentication or     authorization mechanisms and escalate their privileges. (CVE-2010-1323,     CVE-2010-1324, CVE-2010-4020)

    Red Hat would like to thank the MIT Kerberos Team for reporting these     issues.

    This update also fixes the following bug:

    * When attempting to perform PKINIT pre-authentication, if the client had     more than one possible candidate certificate the client could fail to     select the certificate and key to use. This usually occurred if certificate     selection was configured to use the value of the keyUsage extension, or if     any of the candidate certificates did not contain a subjectAltName     extension. Consequently, the client attempted to perform pre-authentication     using a different (usually password-based) mechanism. (BZ#644825)

    All krb5 users should upgrade to these updated packages, which contain     backported patches to correct these issues. After installing the updated     packages, the krb5kdc daemon will be restarted automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered and corrected in krb5 :

An unauthenticated remote attacker could alter a SAM-2 challenge, affecting the prompt text seen by the user or the kind of response sent to the KDC. Under some circumstances, this can negate the incremental security benefit of using a single-use authentication mechanism token. An unauthenticated remote attacker has a 1/256 chance of forging KRB-SAFE messages in an application protocol if the targeted pre-existing session uses an RC4 session key. Few application protocols use KRB-SAFE messages (CVE-2010-1323).

An unauthenticated remote attacker can forge GSS tokens that are intended to be integrity-protected but unencrypted, if the targeted pre-existing application session uses a DES session key. An authenticated remote attacker can forge PACs if using a KDC that does not filter client-provided PAC data. This can result in privilege escalation against a service that relies on PAC contents to make authorization decisions. An unauthenticated remote attacker has a 1/256 chance of swapping a client-issued KrbFastReq into a different KDC-REQ, if the armor key is RC4. The consequences are believed to be minor (CVE-2010-1324).

An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the AD-SIGNEDPATH signature if the TGT key is RC4, allowing it to use self-generated evidence tickets for S4U2Proxy, instead of tickets obtained from the user or with S4U2Self. Configurations using RC4 for the TGT key are believed to be rare. An authenticated remote attacker has a 1/256 chance of forging AD-KDC-ISSUED signatures on authdata elements in tickets having an RC4 service key, resulting in privilege escalation against a service that relies on these signatures. There are no known uses of the KDC-ISSUED authdata container at this time (CVE-2010-4020.

An authenticated remote attacker that controls a legitimate service principal could obtain a valid service ticket to itself containing valid KDC-generated authorization data for a client whose TGS-REQ it has intercepted. The attacker could then use this ticket for S4U2Proxy to impersonate the targeted client even if the client never authenticated to the subverted service. The vulnerable configuration is believed to be rare (CVE-2010-4021).

The updated packages have been patched to correct this issue.

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

Multiple checksum validation flaws were discovered in the MIT Kerberos implementation. A remote attacker could use these flaws to tamper with certain Kerberos protocol packets and, possibly, bypass authentication mechanisms in certain configurations using Single-use Authentication Mechanisms. (CVE-2010-1323)

Red Hat would like to thank the MIT Kerberos Team for reporting these issues.

All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities :

  - Multiple forgery vulnerabilities exist in the bundled     version of MIT Kerberos 5 (krb5). An attacker can     exploit these issues to impersonate a client, escalate     privileges, and disclose sensitive information.
    (CVE-2010-1323, CVE-2010-1324, CVE-2010-4020,     CVE-2010-4021)

  - A local arbitrary code execution vulnerability exists in     the Kernel in the do_anonymous_page() function due to     improper separation of the stack and the heap. A local     attacker can exploit this vulnerability to execute     arbitrary code. (CVE-2010-2240)

  - A denial of service vulnerability exists that allows a     remote attacker to exhaust available sockets, preventing     further connections. (CVE-2011-1785)

  - A denial of service vulnerability exists in the bundled     version of lsassd in Likewise Open. A remote attacker     can exploit this, via an Active Directory login attempt     that provides a username containing an invalid byte     sequence, to cause a daemon crash. (CVE-2011-1786)

Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software. CVE-2010-1323, CVE-2010-1324,CVE-2010-4020 and CVE-2010-4021 have been assigned to this issue.

ID	Name	Product	Family	Published	Updated	Severity
50852	RHEL 6 : krb5 (RHSA-2010:0925)	Nessus	Red Hat Local Security Checks	12/1/2010	4/14/2025	medium
50849	Mandriva Linux Security Advisory : krb5 (MDVSA-2010:246)	Nessus	Mandriva Local Security Checks	12/1/2010	1/6/2021	medium
50863	CentOS 4 / 5 : krb5 (CESA-2010:0926)	Nessus	CentOS Local Security Checks	12/2/2010	1/4/2021	medium
89676	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2011-0007) (remote check)	Nessus	Misc.	3/4/2016	1/6/2021	high
75559	openSUSE Security Update : krb5 (openSUSE-SU-2010:1053-1)	Nessus	SuSE Local Security Checks	6/13/2014	1/14/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

high

medium