The remote host is affected by the vulnerability described in GLSA-200701-14 (Mod_auth_kerb: Denial of Service)

    Mod_auth_kerb improperly handles component byte encoding in the     der_get_oid() function, allowing for a buffer overflow to occur if     there are no components which require more than one byte for encoding.
  Impact :

    An attacker could try to access a Kerberos protected resource on an     Apache server with an incorrectly configured service principal and     crash the server process. It is important to note that this buffer     overflow is not known to allow for the execution of code.
  Workaround :

    There is no known workaround at this time.

Updated mod_auth_kerb packages that fix a security flaw and a bug in multiple realm handling are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

mod_auth_kerb is module for the Apache HTTP Server designed to provide Kerberos authentication over HTTP.

An off by one flaw was found in the way mod_auth_kerb handles certain Kerberos authentication messages. A remote client could send a specially crafted authentication request which could crash an httpd child process (CVE-2006-5989).

A bug in the handling of multiple realms configured using the 'KrbAuthRealms' directive has also been fixed.

All users of mod_auth_kerb should upgrade to these updated packages, which contain backported patches that resolve these issues.

Red Hat セキュリティアドバイザリ 2006:0746 から：

複数のレルム処理に関する 1 件のセキュリティ欠陥および 1 件のバグを修正する、更新済みの mod_auth_kerb パッケージが、Red Hat Enterprise Linux 4 で現在利用可能です。

この更新は、Red Hat セキュリティレスポンスチームによりセキュリティインパクトが小さいと評価されています。

mod_auth_kerb は、HTTP での Kerberos 認証を提供するために設計された Apache HTTP Server 用のモジュールです。

mod_auth_kerb が特定の Kerberos 認証メッセージを処理する方法で、off-by-one の欠陥が見つかりました。リモートのクライアントが特別に細工された認証リクエストを送信し、httpd 子プロセスをクラッシュさせる可能性があります（CVE-2006-5989）。

「KrbAuthRealms」ディレクティブを使用するように構成された複数のレルム処理でのバグも修正されました。

mod_auth_kerb の全ユーザーは、これらの問題を解決するバックポートされたパッチを含む、これらの更新済みパッケージにアップグレードする必要があります。

來自 Red Hat 安全性公告 2006:0746：

現已提供適用於 Red Hat Enterprise Linux 4 的更新版 mod_auth_kerb 套件，可修正多重領域處理中的安全性瑕疵和錯誤。

Red Hat 安全性回應團隊已將此更新評等為具有低安全性影響。

mod_auth_kerb 是適用於 Apache HTTP Server 的模組，專為透過 HTTP 提供 Kerberos 驗證而設計。

在 mod_auth_kerb 處理某些 Kerberos 驗證訊息的方式中發現一個差一瑕疵。遠端用戶端可傳送特製的驗證要求，進而可使 httpd 子處理程序損毀 (CVE-2006-5989)。

也已修正處理使用 'KrbAuthRealms' 指示詞設定之多個領域的錯誤。

所有 mod_auth_kerb 使用者皆應升級至這些更新版套件，其中包含可解決這些問題的反向移植修補程式。

来自 Red Hat 安全公告 2006:0746：

更新后的 mod_auth_kerb 程序包修复了多领域处理中的一个安全问题和一个缺陷，现在可用于 Red Hat Enterprise Linux 4。

Red Hat 安全响应团队将此更新评级为具有低安全影响。

mod_auth_kerb 模块适用于 Apache HTTP Server，用于提供 HTTP 上的 Kerberos 认证。

在 mod_auth_kerb 处理某些 Kerberos 认证消息的方式中发现一个差一缺陷。远程客户端可发送特别构建的认证请求，导致 httpd 子进程崩溃 (CVE-2006-5989)。

还修复了使用“KrbAuthRealms”指令配置的多领域处理中的一个缺陷。

所有 mod_auth_kerb 用户应升级这些更新后的程序包，其中包含用于解决这些问题的向后移植的修补程序。

From Red Hat Security Advisory 2006:0746 :

Updated mod_auth_kerb packages that fix a security flaw and a bug in multiple realm handling are now available for Red Hat Enterprise Linux 4.

This update has been rated as having low security impact by the Red Hat Security Response Team.

mod_auth_kerb is module for the Apache HTTP Server designed to provide Kerberos authentication over HTTP.

An off by one flaw was found in the way mod_auth_kerb handles certain Kerberos authentication messages. A remote client could send a specially crafted authentication request which could crash an httpd child process (CVE-2006-5989).

A bug in the handling of multiple realms configured using the 'KrbAuthRealms' directive has also been fixed.

All users of mod_auth_kerb should upgrade to these updated packages, which contain backported patches that resolve these issues.

An off-by-one error leading to a heap-based buffer overflow has been identified in libapache-mod-auth-kerb, an Apache module for Kerberos authentication. The error could allow an attacker to trigger an application crash or potentially execute arbitrary code by sending a specially crafted kerberos message.

The remote host is running the Apache mod_auth_kerb Kerberos authentication module.  This version of mod_auth_kerb is reported to be vulnerable to a remote buffer overflow.  The details of the attack are not yet known, however, it is alleged that an attacker would be able to crash the system or execute arbitrary code.  In order to exploit this flaw, an attacker would only need to send a malformed Kerberos authentication request. 

ID	名稱	產品	系列	已發布	已更新	嚴重性
24250	GLSA-200701-14 : Mod_auth_kerb: Denial of Service	Nessus	Gentoo Local Security Checks	2007/1/26	2021/1/6	medium
23797	RHEL 4 : mod_auth_kerb (RHSA-2006:0746)	Nessus	Red Hat Local Security Checks	2006/12/11	2021/1/14	medium
67427	Oracle Linux 4：mod_auth_kerb（ELSA-2006-0746）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
67427	Oracle Linux 4：mod_auth_kerb (ELSA-2006-0746)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
67427	Oracle Linux 4：mod_auth_kerb (ELSA-2006-0746)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
67427	Oracle Linux 4 : mod_auth_kerb (ELSA-2006-0746)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
25225	Debian DSA-1247-1 : libapache-mod-auth-kerb - heap overflow	Nessus	Debian Local Security Checks	2007/5/16	2021/1/4	medium
23788	CentOS 4 : mod_auth_kerb (CESA-2006:0746)	Nessus	CentOS Local Security Checks	2006/12/11	2021/1/4	medium
3816	Apache mod_auth_kerb <= 5.20 Buffer Overflow	Nessus Network Monitor	Web Servers	2006/11/22	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium