The remote Solaris system is missing necessary patches to address security updates :

  - The merge_authdata function in kdc_authdata.c in the Key     Distribution Center (KDC) in MIT Kerberos 5 (aka krb5)     1.8.x before 1.8.4 does not properly manage an index     into an authorization-data list, which allows remote     attackers to cause a denial of service (daemon crash),     or possibly obtain sensitive information, spoof     authorization, or execute arbitrary code, via a TGS     request that triggers an uninitialized pointer     dereference, as demonstrated by a request from a Windows     Active Directory client. (CVE-2010-1322)

  - MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x,     1.7.x, and 1.8.x through 1.8.3 does not properly     determine the acceptability of checksums, which might     allow remote attackers to modify user-visible prompt     text, modify a response to a Key Distribution Center     (KDC), or forge a KRB-SAFE message via certain checksums     that (1) are unkeyed or (2) use RC4 keys.
    (CVE-2010-1323)

  - MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3     does not properly determine the acceptability of     checksums, which might allow remote attackers to forge     GSS tokens, gain privileges, or have unspecified other     impact via (1) an unkeyed checksum, (2) an unkeyed PAC     checksum, or (3) a KrbFastArmoredReq checksum based on     an RC4 key. (CVE-2010-1324)

  - MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not     reject RC4 key-derivation checksums, which might allow     remote authenticated users to forge a (1) AD-SIGNEDPATH     or (2) AD-KDC-ISSUED signature, and possibly gain     privileges, by leveraging the small key space that     results from certain one-byte stream-cipher operations.
    (CVE-2010-4020)

  - The Key Distribution Center (KDC) in MIT Kerberos 5 (aka     krb5) 1.7 does not properly restrict the use of TGT     credentials for armoring TGS requests, which might allow     remote authenticated users to impersonate a client by     rewriting an inner request, aka a 'KrbFastReq forgery     issue.' (CVE-2010-4021)

  - Double free vulnerability in the prepare_error_as     function in do_as_req.c in the Key Distribution Center     (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when     the PKINIT feature is enabled, allows remote attackers     to cause a denial of service (daemon crash) or possibly     execute arbitrary code via an e_data field containing     typed data. (CVE-2011-0284)

Multiple remote vulnerabilities in the MIT krb5 package have been fixed. They affect client as well as server software.

This update incorporates the upstream patches to correct bugs outlined in MITKRB5-SA-2010-007 (CVE-2010-1323, CVE-2010-1324, and CVE-2010-4020).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The MIT Kerberos team reports :

MIT krb5 (releases incorrectly accepts RFC 3961 key-derivation checksums using RC4 keys when verifying AD-SIGNEDPATH and AD-KDC-ISSUED authorization data.

An authenticated remote attacker that controls a legitimate service principal has a 1/256 chance of forging the AD-SIGNEDPATH signature if the TGT key is RC4, allowing it to use self-generated 'evidence' tickets for S4U2Proxy, instead of tickets obtained from the user or with S4U2Self. Configurations using RC4 for the TGT key are believed to be rare.

An authenticated remote attacker has a 1/256 chance of forging AD-KDC-ISSUED signatures on authdata elements in tickets having an RC4 service key, resulting in privilege escalation against a service that relies on these signatures. There are no known uses of the KDC-ISSUED authdata container at this time.

a. ESX/ESXi Socket Exhaustion   By sending malicious network traffic to an ESXi or ESX host an  attacker could exhaust the available sockets which would prevent  further connections to the host. In the event a host becomes  inaccessible its virtual machines will continue to run and have  network connectivity but a reboot of the ESXi or ESX host may be  required in order to be able to connect to the host again.

 ESXi and ESX hosts may intermittently lose connectivity caused by  applications that do not correctly close sockets. If this occurs an  error message similar to the following may be written to the vpxa  log :
      socket() returns -1 (Cannot allocate memory)

  An error message similar to the following may be written to the   vmkernel logs :

     socreate(type=2, proto=17) failed with error 55

  VMware would like to thank Jimmy Scott at inet-solutions.be for   reporting this issue to us.

  The Common Vulnerabilities and Exposures Project (cve.mitre.org) has   assigned the name CVE-2011-1785 to this issue.

b. Likewise package update    Updates to the vmware-esx-likewise-openldap and   vmware-esx-likewise-krb5 packages address several security issues.

  One of the vulnerabilities is specific to Likewise while the other   vulnerabilities are present in the MIT version of krb5.
  An incorrect assert() call in Likewise may lead to a termination   of the Likewise-open lsassd service if a username with an illegal   byte sequence is entered for user authentication when logging in to   the Active Directory domain of the ESXi/ESX host. This would lead to   a denial of service.
  The MIT-krb5 vulnerabilities are detailed in MITKRB5-SA-2010-007.

  The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the names CVE-2011-1786 (Likewise-only issue),   CVE-2010-1324, CVE-2010-1323, CVE-2010-4020, CVE-2010-4021 to these   issues.

c. ESX third-party update for Service Console kernel    The Service Console kernel is updated to include a fix for a   security issue.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has   assigned the name CVE-2010-2240 to this issue.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
80653	Oracle Solaris Third-Party Patch Update : kerberos (cve_2010_1322_improper_input)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
50974	SuSE 11 / 11.1 Security Update : krb5 (SAT Patch Numbers 3547 / 3549)	Nessus	SuSE Local Security Checks	2010/12/3	2021/1/14	medium
51099	Fedora 13 : krb5-1.7.1-16.fc13 (2010-18425)	Nessus	Fedora Local Security Checks	2010/12/10	2021/1/11	medium
51102	FreeBSD : krb5 -- RFC 3961 key-derivation checksum handling vulnerability (1d193bba-03f6-11e0-bf50-001a926c7637)	Nessus	FreeBSD Local Security Checks	2010/12/10	2021/1/6	medium
53592	VMSA-2011-0007 : VMware ESXi and ESX Denial of Service and third-party updates for Likewise components and ESX Service Console	Nessus	VMware ESX Local Security Checks	2011/4/29	2021/1/6	medium

检测

插件搜索

medium

medium

medium

medium

medium