An authentication bypass vulnerability exists in the MIT krb5 telnet daemon due to a failure to sanitize malformed usernames. This allows usernames beginning with '-e' to be interpreted as a command-line flag by the login.krb5 program. A remote attacker can exploit this, via a crafted username, to cause login.krb5 to execute part of the BSD rlogin protocol, which in turn allows the attacker to login with an arbitrary username without a password or any further authentication.

Red Hat セキュリティアドバイザリ 2007:0095 から：

多数の問題を修正する更新済みの krb5 パッケージが、現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新には重大なセキュリティインパクトがあるものとして評価しています。

Kerberos は、クライアントとサーバーが対称キー暗号化、信頼できる第三者機関（TTP）、KDC を使用して相互に認証できるようにするネットワーク認証システムです。

MIT krb5 telnet デーモン（telnetd）のユーザー名の処理に、欠陥が見つかりました。ターゲットマシンの telnet ポートにアクセス可能なリモートの攻撃者が、パスワードを要求されることなく、root としてログインする可能性があります。
(CVE-2007-0956)

注意：Red Hat Enterprise Linux のどのバージョンでも、krb5 telnet デーモンはデフォルトで有効になっていません。また、デフォルトのファイアウォール規則により、 telnet ポートへのリモートアクセスがブロックされます。この欠陥は、telnet-server パッケージで配布される telnet デーモンに影響を与えません。

krb5 telnet デーモンを有効にし、これにリモートからアクセスできるユーザーは、この更新をすぐに適用する必要があります。

今回、欠陥が積極的に悪用されるとは認識していませんが、この欠陥の悪用が非常に容易であることを確認しています。

この更新は 2 つの追加のセキュリティ問題も修正します：

Kerberos KDC および kadmin サーバーデーモンに影響を与える、バッファオーバーフローが見つかりました。KDC にアクセスできるリモートの攻撃者が、このバグを悪用して、KDC または kadmin サーバープロセスの権限で任意のコードを実行する可能性があります。(CVE-2007-0957)

kadmin サーバーデーモンが使用する GSSAPI ライブラリに、二重解放の欠陥が見つかりました。Red Hat Enterprise Linux 4 および 5 に、二重解放の欠陥を検出する glibc 内でのチェックが含まれています。このため、Red Hat Enterprise Linux 4 および 5 でこの問題の悪用が成功しても、サービス拒否のみが引き起こされる可能性があります。Red Hat Enterprise Linux の初期のリリースでこのライブラリを使用するアプリケーションも、影響を受ける可能性があります。
(CVE-2007-1216)

全ユーザーは、バックポートされた修正が含まれるこれらのエラータパッケージへ更新し、これらの問題を修正することが推奨されます。

Red Hat は、これらの脆弱性を報告してくれた MIT および iDefense に感謝の意を表します。

認証バイパスの脆弱性がMIT krb5 telnetデーモンに存在します。これは無効な形式のユーザー名をサニタイズできないことによるものです。これにより「-e」で始まるユーザー名が、login.krb5プログラムによってコマンドラインフラグとして解釈される可能性があります。リモート攻撃者がこれを悪用し、細工されたユーザー名を介してlogin.krb5にBSD rloginプロトコルの一部を実行させることで、パスワードや追加の認証なしで、任意のユーザー名を使ってログインする可能性があります。

來自 Red Hat 安全性公告 2007:0095：

現已提供更新版 krb5 套件，可修正數個問題。

Red Hat 安全性回應團隊已將此更新評等為具有重大安全性影響。

Kerberos 是一個網路驗證系統，其可讓用戶端與伺服器彼此透過使用對稱加密與信任的第三方 (即 KDC) 進行驗證。

在 MIT krb5 telnet 程序 (telnetd) 的使用者名稱處理中，發現一個瑕疵。凡是可存取目標電腦之 telnet 連接埠的遠端攻擊者，便能以 root 身分登入且無需密碼。
(CVE-2007-0956)

請注意，依預設不會在任何 Red Hat Enterprise Linux 版本中啟用 krb5 Telnet 程序。此外，預設防火牆規則會封鎖 telnet 連接埠的遠端存取。此瑕疵未影響在 telnet-server 套件中發佈的 telnet 程序。

已啟用 krb5 telnet 程序並從遠端存取的使用者應立即套用此更新。

儘管我們目前尚未發現任何此瑕疵遭到惡意利用的情況，但我們已確定該瑕疵很容易遭到入侵。

此更新也修正了兩個其他安全性問題：

發現影響 Kerberos KDC 和 kadmin 伺服器程序的緩衝區溢位。若遠端攻擊者可存取 KDC，即可惡意利用此錯誤，以 KDC 或 kadmind 伺服器處理程序的權限執行任意程式碼。(CVE-2007-0957)

在 kadmin 伺服器程序所使用的 GSSAPI 程式庫中，發現一個重複釋放瑕疵。Red Hat Enterprise Linux 4 和 5 包含 glibc 中偵測到重複釋放瑕疵的檢查。因此，在 Red Hat Enterprise Linux 4 和 5 上成功惡意利用此問題僅可導致拒絕服務。使用更舊版 Red Hat Enterprise Linux 內此程式庫的應用程式也可能會受到影響。
(CVE-2007-1216)

建議所有使用者皆更新至這些錯字勘誤表套件，其中包含可更正這些問題的反向移植修正。

Red Hat 要感謝 MIT 和 iDefense 報告這些弱點。

来自 Red Hat 安全公告 2007:0095：

更新后的 krb5 程序包修复了许多问题，现在可用。

Red Hat 安全响应团队将此更新评级为具有严重安全影响。

Kerberos 是一套网络认证系统，允许客户端和服务器通过使用对称加密和受信任的第三方（即 KDC）对彼此进行认证。

在 MIT krb5 telnet 后台程序 (telnetd) 的用户名处理中发现一个缺陷。能够访问目标计算机 telnet 端口的远程攻击者可以以根用户身份登入而无需密码。
(CVE-2007-0956)

请注意，krb5 telnet 后台程序默认在任何 Red Hat Enterprise Linux 版本中均不启用。此外，默认防火墙规则阻止远程访问 telnet 端口。此缺陷不影响 telnet-server 程序包中分发的 telnet 后台程序。

对于启用了 krb5 telnet 后台程序并使其可远程访问的用户，应立即应用此更新。

尽管我们不知道该缺陷目前是否已被主动利用，但我们确认该缺陷非常容易被利用。

此更新还修复了两个额外的安全问题：

发现可影响 Kerberos KDC 和 kadmin 服务器后台程序的缓冲区溢出。可访问 KDC 的远程攻击者可利用此缺陷以 KDC 或 kadmin 服务器进程的权限运行任意代码。(CVE-2007-0957)

在 kadmin 服务器后台程序使用的 GSSAPI 库中发现一个双重释放缺陷。Red Hat Enterprise Linux 4 和 5 包含 glibc 内可检测双重释放缺陷的检查。因此，在 Red Hat Enterprise Linux 4 和 5 中成功利用此问题只能导致拒绝服务。Red Hat Enterprise Linux 早期版本中使用此库的应用程序也可能受到影响。
(CVE-2007-1216)

建议所有用户更新这些勘误表程序包，其中包含用于修正这些问题的向后移植的补丁。

Red Hat 在此感谢 MIT 和 iDefense 报告这些漏洞。

MIT krb5 telnet 后台程序中存在一个身份验证绕过漏洞，这是无法审查畸形用户名所致。这允许 login.krb5 程序将以“-e”开头的用户名解释为命令行标记。远程攻击者可利用此缺陷，通过构建的用户名造成 login.krb5 执行部分 BSD rlogin 协议，从而允许攻击者使用任意用户名登录，而无需密码或任何进一步身份验证。

MIT krb5 的 telnet 程序中有一個驗證繞過弱點，這是程序無法清理格式錯誤的使用者名稱所導致。這允許 login.krb5 程式將開頭為「-e」的使用者名稱解譯為命令行旗標。遠端攻擊者可利用此弱點，藉由特製的使用者名稱造成 login.krb5 執行部分 BSD rlogin 通訊協定，進而允許攻擊者以任意使用者名稱登入，而不需要密碼或任何進一步驗證。

A vulnerability was found in the username handling of the MIT krb5 telnet daemon. A remote attacker that could access the telnet port of a target machine could login as root without requiring a password (CVE-2007-0956).

Buffer overflows in the kadmin server daemon were discovered that could be exploited by a remote attacker able to access the KDC.
Successful exploitation could allow for the execution of arbitrary code with the privileges of the KDC or kadmin server processes (CVE-2007-0957).

Finally, a double-free flaw was discovered in the GSSAPI library used by the kadmin server daemon, which could lead to a denial of service condition or the execution of arbitrary code with the privileges of the KDC or kadmin server processes (CVE-2007-1216).

Updated packages have been patched to address this issue.

Update :

Packages for Mandriva Linux 2007.1 are now available.

Several remote vulnerabilities have been discovered in the MIT reference implementation of the Kerberos network authentication protocol suite, which may lead to the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-0956     It was discovered that the krb5 telnet daemon performs     insufficient validation of usernames, which might allow     unauthorized logins or privilege escalation.

  - CVE-2007-0957     iDefense discovered that a buffer overflow in the     logging code of the KDC and the administration daemon     might lead to arbitrary code execution.

  - CVE-2007-1216     It was discovered that a double free in the RPCSEC_GSS     part of the GSS library code might lead to arbitrary     code execution.

When using the krb5 telnet daemon it was possible for remote attackers to override authentication mechanisms and gain root access to the machine by supplying a special username. 

This is tracked by the Mitre CVE ID CVE-2007-0956.

The krb5 telnet service did not appropriately verify user names. A remote attacker could log in as the root user by requesting a specially crafted user name. (CVE-2007-0956)

The krb5 syslog library did not correctly verify the size of log messages. A remote attacker could send a specially crafted message and execute arbitrary code with root privileges. (CVE-2007-0957)

The krb5 administration service was vulnerable to a double-free in the GSS RPC library. A remote attacker could send a specially crafted request and execute arbitrary code with root privileges.
(CVE-2007-1216).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

From Red Hat Security Advisory 2007:0095 :

Updated krb5 packages that fix a number of issues are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC.

A flaw was found in the username handling of the MIT krb5 telnet daemon (telnetd). A remote attacker who can access the telnet port of a target machine could log in as root without requiring a password.
(CVE-2007-0956)

Note that the krb5 telnet daemon is not enabled by default in any version of Red Hat Enterprise Linux. In addition, the default firewall rules block remote access to the telnet port. This flaw does not affect the telnet daemon distributed in the telnet-server package.

For users who have enabled the krb5 telnet daemon and have it accessible remotely, this update should be applied immediately.

Whilst we are not aware at this time that the flaw is being actively exploited, we have confirmed that the flaw is very easily exploitable.

This update also fixes two additional security issues :

Buffer overflows were found which affect the Kerberos KDC and the kadmin server daemon. A remote attacker who can access the KDC could exploit this bug to run arbitrary code with the privileges of the KDC or kadmin server processes. (CVE-2007-0957)

A double-free flaw was found in the GSSAPI library used by the kadmin server daemon. Red Hat Enterprise Linux 4 and 5 contain checks within glibc that detect double-free flaws. Therefore, on Red Hat Enterprise Linux 4 and 5 successful exploitation of this issue can only lead to a denial of service. Applications which use this library in earlier releases of Red Hat Enterprise Linux may also be affected.
(CVE-2007-1216)

All users are advised to update to these erratum packages which contain a backported fix to correct these issues.

Red Hat would like to thank MIT and iDefense for reporting these vulnerabilities.

Updated krb5 packages that fix a number of issues are now available.

This update has been rated as having critical security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC.

A flaw was found in the username handling of the MIT krb5 telnet daemon (telnetd). A remote attacker who can access the telnet port of a target machine could log in as root without requiring a password.
(CVE-2007-0956)

Note that the krb5 telnet daemon is not enabled by default in any version of Red Hat Enterprise Linux. In addition, the default firewall rules block remote access to the telnet port. This flaw does not affect the telnet daemon distributed in the telnet-server package.

For users who have enabled the krb5 telnet daemon and have it accessible remotely, this update should be applied immediately.

Whilst we are not aware at this time that the flaw is being actively exploited, we have confirmed that the flaw is very easily exploitable.

This update also fixes two additional security issues :

Buffer overflows were found which affect the Kerberos KDC and the kadmin server daemon. A remote attacker who can access the KDC could exploit this bug to run arbitrary code with the privileges of the KDC or kadmin server processes. (CVE-2007-0957)

A double-free flaw was found in the GSSAPI library used by the kadmin server daemon. Red Hat Enterprise Linux 4 and 5 contain checks within glibc that detect double-free flaws. Therefore, on Red Hat Enterprise Linux 4 and 5 successful exploitation of this issue can only lead to a denial of service. Applications which use this library in earlier releases of Red Hat Enterprise Linux may also be affected.
(CVE-2007-1216)

All users are advised to update to these erratum packages which contain a backported fix to correct these issues.

Red Hat would like to thank MIT and iDefense for reporting these vulnerabilities.

SEAM 1.0.2: patch for Solaris 9.
Date this patch was last updated by Sun : Apr/03/07

The remote host is affected by the vulnerability described in GLSA-200704-02 (MIT Kerberos 5: Arbitrary remote code execution)

    The Kerberos telnet daemon fails to properly handle usernames allowing     unauthorized access to any account (CVE-2007-0956). The Kerberos     administration daemon, the KDC and possibly other applications using     the MIT Kerberos libraries are vulnerable to the following issues. The     krb5_klog_syslog function from the kadm5 library fails to properly     validate input leading to a stack overflow (CVE-2007-0957). The GSS-API     library is vulnerable to a double-free attack (CVE-2007-1216).
  Impact :

    By exploiting the telnet vulnerability a remote attacker may obtain     access with root privileges. The remaining vulnerabilities may allow an     authenticated remote attacker to execute arbitrary code with root     privileges.
  Workaround :

    There is no known workaround at this time.

ID	名稱	產品	系列	已發布	已更新	嚴重性
24998	Kerberos telnet Crafted Username Remote Authentication Bypass	Nessus	Gain a shell remotely	2007/4/5	2022/4/11	high
67458	Oracle Linux 3/4/5：krb5（ELSA-2007-0095）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
24998	Kerberos telnetの細工されたユーザー名のリモート認証バイパス	Nessus	Gain a shell remotely	2007/4/5	2022/4/11	high
67458	Oracle Linux 3 / 4 / 5 : krb5 (ELSA-2007-0095)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67458	Oracle Linux 3 / 4 / 5：krb5 (ELSA-2007-0095)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
24998	Kerberos telnet 构建的用户名远程认证绕过	Nessus	Gain a shell remotely	2007/4/5	2022/4/11	high
24998	Kerberos telnet 特製使用者名稱遠端驗證繞過	Nessus	Gain a shell remotely	2007/4/5	2022/4/11	high
24943	Mandrake Linux Security Advisory : krb5 (MDKSA-2007:077-1)	Nessus	Mandriva Local Security Checks	2007/4/5	2021/1/6	high
25010	Debian DSA-1276-1 : krb5 - several vulnerabilities	Nessus	Debian Local Security Checks	2007/4/10	2021/1/4	high
27313	openSUSE 10 Security Update : krb5-apps-servers (krb5-apps-servers-3021)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
28046	Ubuntu 5.10 / 6.06 LTS / 6.10 : krb5 vulnerabilities (USN-449-1)	Nessus	Ubuntu Local Security Checks	2007/11/10	2021/1/19	high
67458	Oracle Linux 3 / 4 / 5 : krb5 (ELSA-2007-0095)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
24919	CentOS 3 / 4 : krb5 (CESA-2007:0095)	Nessus	CentOS Local Security Checks	2007/4/5	2021/1/4	high
23517	Solaris 9 (sparc) : 116462-06	Nessus	Solaris Local Security Checks	2006/11/6	2021/1/14	high
24935	GLSA-200704-02 : MIT Kerberos 5: Arbitrary remote code execution	Nessus	Gentoo Local Security Checks	2007/4/5	2021/1/6	high
24948	RHEL 2.1 / 3 / 4 / 5 : krb5 (RHSA-2007:0095)	Nessus	Red Hat Local Security Checks	2007/4/5	2021/1/14	high
29497	SuSE 10 Security Update : krb5-apps-servers (ZYPP Patch Number 3022)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high