The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0068 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-25563:
    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A     32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal     buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length     this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context`     entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to     65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version     1.2.0 contains a patch for the out-of-bounds reads.

    CVE-2023-25564:
    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was     not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()`     were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write     hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can     trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the     main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0.

    CVE-2023-25565:
    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The     error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be     freed. However, that is not the case. This vulnerability can be triggered via the main     `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a     denial-of-service. This issue is fixed in version 1.2.0.

    CVE-2023-25566:
    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-     service. The domain portion of a username may be overridden causing an allocated memory area the size of     the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry     point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0.

    CVE-2023-25567:
    GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-     bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not     checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read     can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if     the memory is unmapped. The issue is fixed in version 1.2.0.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7588-1 advisory.

    Phil Turnbull discovered that GSS NTLMSSP may perform out-of-bounds reads

    when decoding NTLM fields and target information. An attacker could

    possibly use this issue to cause GSS NTLMSSP to crash, resulting in

    a denial of service. (CVE-2023-25563, CVE-2023-25567)

    Phil Turnbull discovered that GSS NTLMSSP did not properly initialize memory when decoding UTF16 strings.
    An attacker could possibly use

    this issue to trigger an out-of-bounds write, resulting in a crash. (CVE-2023-25564)

    Phil Turnbull discovered that GSS NTLMSSP did not properly handle memory cleanup. An attacker could     possibly use this issue to cause an assertion failure, resulting in a denial of service. (CVE-2023-25565)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-3097 advisory.

    - Fix CVE-2023-25563: multiple out-of-bounds read when decoding NTLM fields
    - Fix CVE-2023-25564: memory corruption when decoding UTF16 strings
    - Fix CVE-2023-25565: incorrect free when decoding target information
    - Fix CVE-2023-25566: memory leak when parsing usernames
    - Fix CVE-2023-25567: out-of-bounds read when decoding target information

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2023:3097 advisory.

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A     32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal     buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length     this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context`     entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to     65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version     1.2.0 contains a patch for the out-of-bounds reads. (CVE-2023-25563)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was     not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()`     were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write     hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can     trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the     main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0. (CVE-2023-25564)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The     error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be     freed. However, that is not the case. This vulnerability can be triggered via the main     `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a     denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25565)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-     service. The domain portion of a username may be overridden causing an allocated memory area the size of     the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry     point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25566)

  - GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-     bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not     checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read     can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if     the memory is unmapped. The issue is fixed in version 1.2.0. (CVE-2023-25567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-cb63c0f615 advisory.

    Patched several CVEs reported by GitHub Security Lab

        CVE-2023-25563         CVE-2023-25564         CVE-2023-25565         CVE-2023-25566         CVE-2023-25567


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:3097 advisory.

    The gssntlmssp is a GSSAPI NTLM mechanism that allows to perform NTLM authentication in GSSAPI programs.

    Security Fix(es):

    * gssntlmssp: multiple out-of-bounds read when decoding NTLM fields (CVE-2023-25563)

    * gssntlmssp: memory corruption when decoding UTF16 strings (CVE-2023-25564)

    * gssntlmssp: incorrect free when decoding target information (CVE-2023-25565)

    * gssntlmssp: memory leak when parsing usernames (CVE-2023-25566)

    * gssntlmssp: out-of-bounds read when decoding target information (CVE-2023-25567)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0048-1 advisory.

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A     32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal     buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length     this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context`     entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to     65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version     1.2.0 contains a patch for the out-of-bounds reads. (CVE-2023-25563)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was     not initialized and could cause writing a zero to an arbitrary place in memory if `ntlm_str_convert()`     were to fail, which would leave `outlen` uninitialized. This can lead to a denial of service if the write     hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can     trigger an out-of-bounds write, leading to memory corruption. This vulnerability can be triggered via the     main `gss_accept_sec_context` entry point. This issue is fixed in version 1.2.0. (CVE-2023-25564)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The     error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be     freed. However, that is not the case. This vulnerability can be triggered via the main     `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a     denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25565)

  - GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to     version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-     service. The domain portion of a username may be overridden causing an allocated memory area the size of     the domain name to be leaked. An attacker can leak memory via the main `gss_accept_sec_context` entry     point, potentially causing a denial-of-service. This issue is fixed in version 1.2.0. (CVE-2023-25566)

  - GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-     bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not     checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read     can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if     the memory is unmapped. The issue is fixed in version 1.2.0. (CVE-2023-25567)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-     bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not     checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read     can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if     the memory is unmapped. The issue is fixed in version 1.2.0. (CVE-2023-25567)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0084 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2023-25563:
      A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM     authentication. Multiple out-of-bounds reads occur when decoding NTLM fields and can trigger a denial of     service. A 32-bit integer overflow condition can lead to incorrect checks of the consistency of the length     of internal buffers. Although most applications will error out before accepting a single input buffer of     4GB in length, this issue can happen. This vulnerability can be triggered via the main     gss_accept_sec_context entry point if the application allows tokens greater than 4GB in length, leading to     a large, up to 65KB, out-of-bounds read, which could cause a denial of service if it reads from unmapped     memory.
      CVE-2023-25564:
      A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM     authentication. Memory corruption can be triggered when decoding UTF16 strings. The variable outlen was     not initialized and could cause writing a zero to an arbitrary place in memory if the ntlm_str_convert()     fails, which would leave outlen uninitialized. This issue can lead to a denial of service if the write     hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can     trigger an out-of-bounds write, leading to memory corruption, and can be triggered via the main     gss_accept_sec_context entry point.
      CVE-2023-25565:
      A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM     authentication. An incorrect free when decoding target information can trigger a denial of service. The     error condition incorrectly assumes the cb and sh buffers contain a copy of the data that needs to be     freed. However, that is not the case. This vulnerability can be triggered via the main     gss_accept_sec_context entry point. This issue will likely trigger an assertion failure in free, causing a     denial of service.
      CVE-2023-25566:
      A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM     authentication. A memory leak can be triggered when parsing usernames, triggering a denial of service. The     domain portion of a username may be overridden, causing an allocated memory area the size of the domain     name to be leaked. This flaw allows an attacker to leak memory via the main gss_accept_sec_context entry     point, potentially causing a denial of service.
      CVE-2023-25567:
      A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM     authentication. It has an out-of-bounds read when decoding target information. The length of the av_pair     is not checked properly for two of the elements, which can trigger an out-of-bounds read via the main     gss_accept_sec_context entry point and could cause a denial of service if the memory is unmapped.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
236292	Alibaba Cloud Linux 3 : 0068: gssntlmssp (ALINUX3-SA-2023:0068)	Nessus	Alibaba Cloud Linux Local Security Checks	5/14/2025	5/14/2025	high
240491	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : GSS NTLMSSP vulnerabilities (USN-7588-1)	Nessus	Ubuntu Local Security Checks	6/25/2025	6/25/2025	high
176343	Oracle Linux 8 : gssntlmssp (ELSA-2023-3097)	Nessus	Oracle Linux Local Security Checks	5/24/2023	10/22/2024	high
176127	AlmaLinux 8 : gssntlmssp (ALSA-2023:3097)	Nessus	Alma Linux Local Security Checks	5/19/2023	5/19/2023	high
171779	Fedora 37 : gssntlmssp (2023-cb63c0f615)	Nessus	Fedora Local Security Checks	2/22/2023	11/14/2024	high
175842	RHEL 8 : gssntlmssp (RHSA-2023:3097)	Nessus	Red Hat Local Security Checks	5/16/2023	11/7/2024	high
171632	openSUSE 15 Security Update : gssntlmssp (openSUSE-SU-2023:0048-1)	Nessus	SuSE Local Security Checks	2/19/2023	2/23/2023	high
225933	Linux Distros Unpatched Vulnerability : CVE-2023-25567	Nessus	Misc.	3/5/2025	10/28/2025	high
238862	TencentOS Server 3: gssntlmssp (TSSA-2023:0084)	Nessus	Tencent Local Security Checks	6/16/2025	11/20/2025	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high