Clients sending negotiation requests with invalid flags could crash the kerberos server (CVE-2009-0845).

GSS-API clients could crash when reading from an invalid address space (CVE-2009-0844).

Invalid length checks could crash applications using the kerberos ASN.1 parser (CVE-2009-0847).

Under certain circumstances the ASN.1 parser could free an uninitialized pointer which could crash a kerberos server or even lead to execution of arbitrary code (CVE-2009-0846).

Updated krb5 packages that fix various security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC). The Generic Security Service Application Program Interface (GSS-API) definition provides security services to callers (protocols) in a generic fashion. The Simple and Protected GSS-API Negotiation (SPNEGO) mechanism is used by GSS-API peers to choose from a common set of security mechanisms.

An input validation flaw was found in the ASN.1 (Abstract Syntax Notation One) decoder used by MIT Kerberos. A remote attacker could use this flaw to crash a network service using the MIT Kerberos library, such as kadmind or krb5kdc, by causing it to dereference or free an uninitialized pointer. (CVE-2009-0846)

Multiple input validation flaws were found in the MIT Kerberos GSS-API library's implementation of the SPNEGO mechanism. A remote attacker could use these flaws to crash any network service utilizing the MIT Kerberos GSS-API library to authenticate users or, possibly, leak portions of the service's memory. (CVE-2009-0844, CVE-2009-0845)

All krb5 users should upgrade to these updated packages, which contain backported patches to correct these issues. All running services using the MIT Kerberos libraries must be restarted for the update to take effect.

From Red Hat Security Advisory 2009:0409 :

Updated krb5 packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third party, the Key Distribution Center (KDC).

An input validation flaw was found in the ASN.1 (Abstract Syntax Notation One) decoder used by MIT Kerberos. A remote attacker could use this flaw to crash a network service using the MIT Kerberos library, such as kadmind or krb5kdc, by causing it to dereference or free an uninitialized pointer. (CVE-2009-0846)

All krb5 users should upgrade to these updated packages, which contain a backported patch to correct this issue. All running services using the MIT Kerberos libraries must be restarted for the update to take effect.

Clients sending negotiation requests with invalid flags could crash the kerberos server. (CVE-2009-0845)

GSS-API clients could crash when reading from an invalid address space. (CVE-2009-0844)

Invalid length checks could crash applications using the kerberos ASN.1 parser. (CVE-2009-0847)

Under certain circumstances the ASN.1 parser could free an uninitialized pointer which could crash a kerberos server or even lead to execution of arbitrary code. (CVE-2009-0846)

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds read error exists in the MIT Kerberos     SPNEGO implementation in the get_input_token() function.
    A remote attacker can exploit this, via a crafted     length value, to cause a denial of service or to obtain     access to sensitive information. (CVE-2009-0844)

  - A NULL pointer dereference flaw exists in MIT Kerberos     in the spnego_gss_accept_sec_context() function when     SPNEGO is used. A remote attacker can exploit this, via     invalid ContextFlags data in the 'reqFlags' field within     a 'negTokenInit' token, to cause a denial of service.
    (CVE-2009-0845)

  - A flaw exists in the MIT Kerberos ASN.1 GeneralizedTime     decoder in the asn1_decode_generaltime() function. A     remote attacker can exploit this, via vectors involving     invalid DER encoding, to free an uninitialized pointer,     resulting in a denial of service or the execution of     arbitrary code. (CVE-2009-0846)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2009-0408 advisory.

    - update to revised patch for CVE-2009-0844/CVE-2009-0845
    - add fix for potential buffer read overrun in the SPNEGO GSSAPI mechanism       (#490635, CVE-2009-0844)
    - add fix for NULL pointer dereference when handling certain error cases       in the SPNEGO GSSAPI mechanism (#490635, CVE-2009-0845)
    - add fix for attempt to free uninitialized pointer in the ASN.1 decoder       (#490635, CVE-2009-0846)
    - add fix for bug in length validation in the ASN.1 decoder (CVE-2009-0847)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism (CVE-2009-0844, CVE-2009-0845), attempts to free an uninitialized pointer during protocol parsing (CVE-2009-0846), and a bug in length validation during protocol parsing (CVE-2009-0847).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in the MIT reference implementation of Kerberos V5, a system for authenticating users and services on a network. The Common Vulnerabilities and Exposures project identified the following problems :

  - CVE-2009-0844     The Apple Product Security team discovered that the     SPNEGO GSS-API mechanism suffers of a missing bounds     check when reading a network input buffer which results     in an invalid read crashing the application or possibly     leaking information.

  - CVE-2009-0845     Under certain conditions the SPNEGO GSS-API mechanism     references a NULL pointer which crashes the application     using the library.

  - CVE-2009-0847     An incorrect length check inside the ASN.1 decoder of     the MIT krb5 implementation allows an unauthenticated     remote attacker to crash of the kinit or KDC program.

  - CVE-2009-0846     Under certain conditions the the ASN.1 decoder of the     MIT krb5 implementation frees an uninitialized pointer     which could lead to denial of service and possibly     arbitrary code execution.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2009:0409 advisory.

    Kerberos is a network authentication system which allows clients and     servers to authenticate to each other using symmetric encryption and a     trusted third party, the Key Distribution Center (KDC).

    An input validation flaw was found in the ASN.1 (Abstract Syntax Notation     One) decoder used by MIT Kerberos. A remote attacker could use this flaw to     crash a network service using the MIT Kerberos library, such as kadmind or     krb5kdc, by causing it to dereference or free an uninitialized pointer.
    (CVE-2009-0846)

    All krb5 users should upgrade to these updated packages, which contain a     backported patch to correct this issue. All running services using the MIT     Kerberos libraries must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has krb5 packages installed that are affected by multiple vulnerabilities:

  - plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles     Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial     of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related     to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use     cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin     code that is specific to Red Hat. (CVE-2017-15088)

  - The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT     Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute     arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error     condition. (CVE-2011-0285)

  - schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly     validate UDP packets before sending responses, which allows remote attackers to cause a denial of service     (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by     krb_pingpong.nasl, a related issue to CVE-1999-0103. (CVE-2002-2443)

  - The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b)     Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to     gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known     whether an exploitable attack scenario exists for these issues. (CVE-2006-3084)

  - The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration     daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in     freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute     arbitrary code via unspecified vectors. (CVE-2006-6143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
40253	openSUSE Security Update : krb5 (krb5-740)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical
43739	CentOS 5 : krb5 (CESA-2009:0408)	Nessus	CentOS Local Security Checks	2010/1/6	2021/1/4	critical
67837	Oracle Linux 4 : krb5 (ELSA-2009-0409)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	critical
41542	SuSE 10 Security Update : Kerberos (ZYPP Patch Number 6140)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
89114	VMware ESX Multiple Vulnerabilities (VMSA-2009-0008) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	critical
67836	Oracle Linux 5 : krb5 (ELSA-2009-0408)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/23	high
41415	SuSE 11 Security Update : Kerberos (SAT Patch Number 738)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
36108	Fedora 9 : krb5-1.6.3-16.fc9 (2009-2834)	Nessus	Fedora Local Security Checks	2009/4/8	2021/1/11	critical
36120	Debian DSA-1766-1 : krb5 - several vulnerabilities	Nessus	Debian Local Security Checks	2009/4/9	2021/1/4	critical
36122	openSUSE 10 Security Update : krb5 (krb5-6139)	Nessus	SuSE Local Security Checks	2009/4/9	2021/1/14	critical
36113	RHEL 4 : krb5 (RHSA-2009:0409)	Nessus	Red Hat Local Security Checks	2009/4/8	2025/3/20	high
301200	NewStart CGSL MAIN 6.06 (SP) : krb5 Multiple Vulnerabilities (NS-SA-2026-0007)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

high

critical