This update incorporates the upstream fix for possible NULL pointer dereferences which could occur if a client sent a malformed PKINIT request to a KDC (CVE-2013-1415), or if a client sent a draft9 PKINIT request to a KDC (CVE-2012-1016).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

When a client attempts to use PKINIT to obtain credentials from the KDC, the client can specify, using an issuer and serial number, which of the KDC's possibly-many certificates the client has in its possession, as a hint to the KDC that it should use the corresponding key to sign its response. If that specification was malformed, the KDC could attempt to dereference a NULL pointer and crash. (CVE-2013-1415)

When a client attempts to use PKINIT to obtain credentials from the KDC, the client will typically format its request to conform to the specification published in RFC 4556. For interoperability reasons, clients and servers also provide support for an older, draft version of that specification. If a client formatted its request to conform to this older version of the specification, with a non-default key agreement option, it could cause the KDC to attempt to dereference a NULL pointer and crash. (CVE-2012-1016)

After installing the updated packages, the krb5kdc daemon will be restarted automatically.

No advisory has been released yet.

Fix a NULL pointer dereference in the KDC PKINIT code [CVE-2013-1415].

Updated krb5 packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).

When a client attempts to use PKINIT to obtain credentials from the KDC, the client can specify, using an issuer and serial number, which of the KDC's possibly-many certificates the client has in its possession, as a hint to the KDC that it should use the corresponding key to sign its response. If that specification was malformed, the KDC could attempt to dereference a NULL pointer and crash. (CVE-2013-1415)

When a client attempts to use PKINIT to obtain credentials from the KDC, the client will typically format its request to conform to the specification published in RFC 4556. For interoperability reasons, clients and servers also provide support for an older, draft version of that specification. If a client formatted its request to conform to this older version of the specification, with a non-default key agreement option, it could cause the KDC to attempt to dereference a NULL pointer and crash. (CVE-2012-1016)

All krb5 users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0656 advisory.

    - incorporate upstream patch to fix a NULL pointer dereference when the client       supplies an otherwise-normal-looking PKINIT request (CVE-2013-1415, #917909)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-280:01 advisory.

    Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's     security by eliminating the insecure practice of cleartext passwords.
    Security issues fixed with this release:
     CVE-2012-1016     The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT     implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to     find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a     denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request.
     CVE-2013-1415     The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT     implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x     before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which     allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a     malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.
    Fixed bugs:
     Upgraded to upstream version 1.10.3; in particular, better support of cross-domain trust functionality in     other packages.
     Previous versions of libsmbclient depended on the krb5_locate_kdc() function. As it is no longer     supported, older version of libsmbclient did not function after updating Kerberos. To fix this, an     explicit conflict with older versions of libsmbclient has been added, which prevents incompatible     combinations.
     Leaving the krb5-auth-dialog application prompter hanging for a long period of time triggered a large     clock drift that was applied at the next kinit session. This has been fixed.
     Previously, certain KDC implementations omitted some KDC's certificates contained in a PKINIT list of     trusted roots and the client failed to verify the signature on the data. This has been fixed, the client     can now use its own copies for the relevant certificates and verification works as expected.
     Previously, when a client's libraries and the KDC supported AES and if a keytab file did not contain the     AES keys, using the kinit command with this file failed because the strongest encryption (AES) was used.
    This has been fixed: the encryption in the keytab file is now used, if supported.
     Fixed krb5 entering a loop because of timeout variable mishandling.
     Previously, passwd failed with the token manipulation error error message if used by an Identity     Management client. This has been fixed.
     Fixed some performance issue related to repeated SELinux file context configuration being reloaded every     time the replay cached was flushed.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
65657	Fedora 18 : krb5-1.10.3-14.fc18 (2013-3147)	Nessus	Fedora Local Security Checks	2013/3/23	2021/1/11	high
65606	Scientific Linux Security Update : krb5 on SL6.x i386/x86_64 (20130318)	Nessus	Scientific Linux Local Security Checks	2013/3/19	2021/1/14	high
64860	FreeBSD : krb5 -- NULL pointer dereference in the KDC PKINIT code [CVE-2013-1415] (f54584bc-7d2b-11e2-9bd1-206a8a720317)	Nessus	FreeBSD Local Security Checks	2013/2/24	2021/1/6	high
65618	CentOS 6 : krb5 (CESA-2013:0656)	Nessus	CentOS Local Security Checks	2013/3/20	2021/1/4	high
68792	Oracle Linux 6 : krb5 (ELSA-2013-0656)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
289432	MiracleLinux 4 : krb5-1.10.3-10.AXS4.1 (AXSA:2013-280:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high

检测

插件搜索

high

high

high

high

high

high