A NULL pointer dereference flaw was found in MIT Kerberos kadmind service. An authenticated attacker with permission to modify a principal entry could use this flaw to cause kadmind to dereference a NULL pointer and crash by supplying an empty DB argument to the modify_principal command, if kadmind was configured to use the LDAP KDB module. (CVE-2016-3119)

A NULL pointer dereference flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to dereference a NULL pointer and crash by making an S4U2Self request, if the restrict_anonymous_to_tgt option was set to true.
(CVE-2016-3120)

The remote NewStart CGSL host, running version MAIN 6.06 (SP), has krb5 packages installed that are affected by multiple vulnerabilities:

  - plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles     Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial     of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related     to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use     cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin     code that is specific to Red Hat. (CVE-2017-15088)

  - The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT     Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute     arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error     condition. (CVE-2011-0285)

  - schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly     validate UDP packets before sending responses, which allows remote attackers to cause a denial of service     (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by     krb_pingpong.nasl, a related issue to CVE-1999-0103. (CVE-2002-2443)

  - The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b)     Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to     gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known     whether an exploitable attack scenario exists for these issues. (CVE-2006-3084)

  - The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration     daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in     freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute     arbitrary code via unspecified vectors. (CVE-2006-6143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for krb5 fixes the following security issue :

  - CVE-2016-3119: An authenticated attacker with permission     to modify a principal entry could have caused kadmind to     dereference a NULL pointer by supplying an empty DB     argument to the modify_principal command, if kadmind is     configured to use the LDAP KDB module. (bsc#971942)

This update for krb5 fixes the following security issue :

  - CVE-2016-3119: An authenticated attacker with permission     to modify a principal entry could have caused kadmind to     dereference a NULL pointer by supplying an empty DB     argument to the modify_principal command, if kadmind is     configured to use the LDAP KDB module. (bsc#971942)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker     with permission to modify a principal entry could use     this flaw to cause kadmind to dereference a NULL     pointer and crash by supplying an empty DB argument to     the modify_principal command, if kadmind was configured     to use the LDAP KDB module. (CVE-2016-3119)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following packages have been upgraded to a newer upstream version:
krb5 (1.14.1).

Security Fix(es) :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker with     permission to modify a principal entry could use this     flaw to cause kadmind to dereference a NULL pointer and     crash by supplying an empty DB argument to the     modify_principal command, if kadmind was configured to     use the LDAP KDB module. (CVE-2016-3119)

  - A NULL pointer dereference flaw was found in MIT     Kerberos krb5kdc service. An authenticated attacker     could use this flaw to cause krb5kdc to dereference a     NULL pointer and crash by making an S4U2Self request, if     the restrict_anonymous_to_tgt option was set to true.
    (CVE-2016-3120)

Additional Changes :

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in MIT     Kerberos kadmind service. An authenticated attacker     with permission to modify a principal entry could use     this flaw to cause kadmind to dereference a NULL     pointer and crash by supplying an empty DB argument to     the modify_principal command, if kadmind was configured     to use the LDAP KDB module. (CVE-2016-3119)

  - A NULL pointer dereference flaw was found in MIT     Kerberos krb5kdc service. An authenticated attacker     could use this flaw to cause krb5kdc to dereference a     NULL pointer and crash by making an S4U2Self request,     if the restrict_anonymous_to_tgt option was set to     true.(CVE-2016-3120)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0067 advisory.

    This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 8.6. It addresses 72 CVEs:
    CVE-2008-0947, CVE-2016-3120, CVE-2012-1014, CVE-2017-15088, CVE-2014-9422, and 67 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1422 advisory.

    This advisory aggregates security fixes for the krb5 SRPM in CIQ LTS 9.6. It addresses 80 CVEs:
    CVE-2009-0845, CVE-2008-0947, CVE-2016-3120, CVE-2024-3596, CVE-2012-1014, and 75 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
97023	Amazon Linux AMI : krb5 (ALAS-2017-793)	Nessus	Amazon Linux Local Security Checks	2017/2/7	2026/1/1	medium
301200	NewStart CGSL MAIN 6.06 (SP) : krb5 Multiple Vulnerabilities (NS-SA-2026-0007)	Nessus	NewStart CGSL Local Security Checks	2026/3/6	2026/3/9	critical
90341	openSUSE Security Update : krb5 (openSUSE-2016-424)	Nessus	SuSE Local Security Checks	2016/4/5	2021/1/19	medium
90586	SUSE SLES11 Security Update : krb5 (SUSE-SU-2016:1088-1)	Nessus	SuSE Local Security Checks	2016/4/19	2021/1/19	medium
119067	EulerOS Virtualization 2.5.1 : krb5 (EulerOS-SA-2018-1376)	Nessus	Huawei Local Security Checks	2018/11/21	2025/3/24	medium
90506	SUSE SLED12 / SLES12 Security Update : krb5 (SUSE-SU-2016:0994-1)	Nessus	SuSE Local Security Checks	2016/4/13	2021/1/6	medium
95842	Scientific Linux Security Update : krb5 on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/14	medium
99836	EulerOS 2.0 SP1 : krb5 (EulerOS-SA-2016-1076)	Nessus	Huawei Local Security Checks	2017/5/1	2025/12/22	medium
358952	Rocky Linux 8.6 [CIQ] Security Update: krb5-devel / krb5-devel-debuginfo / krb5-libs / krb5-libs-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0067)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/12	critical
354310	Rocky Linux 9.6 [CIQ] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc Multiple Vulnerabilities (ciqsa-2026_1422)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/13	critical

偵測

搜尋 Plugin

medium

critical

medium

medium

medium

medium

medium

medium

critical

critical