|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Gentoo Local Security Checks >> [GLSA-200507-11] MIT Kerberos 5: Multiple vulnerabilities Vulnerability Assessment Details
|
[GLSA-200507-11] MIT Kerberos 5: Multiple vulnerabilities |
||
MIT Kerberos 5: Multiple vulnerabilities Detailed Explanation for this Vulnerability Assessment The remote host is affected by the vulnerability described in GLSA-200507-11 (MIT Kerberos 5: Multiple vulnerabilities) Daniel Wachdorf discovered that MIT Kerberos 5 could corrupt the heap by freeing unallocated memory when receiving a special TCP request (CVE-2005-1174). He also discovered that the same request could lead to a single-byte heap overflow (CVE-2005-1175). Magnus Hagander discovered that krb5_recvauth() function of MIT Kerberos 5 might try to double-free memory (CVE-2005-1689). Impact Although exploitation is considered difficult, a remote attacker could exploit the single-byte heap overflow and the double-free vulnerability to execute arbitrary code, which could lead to the compromise of the whole Kerberos realm. A remote attacker could also use the heap corruption to cause a Denial of Service. Workaround There are no known workarounds at this time. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1174 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1175 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1689 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-002-kdc.txt http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-003-recvauth.txt Solution: All MIT Kerberos 5 users should upgrade to the latest available version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.4.1-r1" Network Security Threat Level: High Networks Security ID: Vulnerability Assessment Copyright: (C) 2005 Michel Arboi |
||
Cables, Connectors |
HP PROLIANT MICROSERVER MICRO SERVER HSTNS-5151 T4 Used.
$45.00
HP ProLiant Xeon E3-1220L V2 16 GB RAM 2.30 GHz MicroServer Gen8 NO DRIVES
$174.99
HPE PROLIANT MICROSERVER GEN10 PLUS MICRO TOWER SERVER - USED
$550.00
SuperMicro Server 505-2 Intel Atom 2.4GHz 8GB RAM SYS-5018A-FTN4 1U Rackmount
$202.49
HPE Proliant Microserver Gen10 X3421 Perf AMS, P03698-S01, 16GB Ram
$299.00
HP ProLiant HSTNS-5151 Micro Server 8GB RAM No Drives/Key/Caddies *READ*
$94.99
Supermicro Server Tower Xeon BOOTS E5-2620 v4 2.10GHz 64GB RAM NO HDD NO OS
$199.99
SUPERMICRO CSE-512 AMD Opteron Processor 6128, 32GB DDR3 RAM NO HDD
$90.00
1U Supermicro Server 10 Bay 2x Intel Xeon 3.3Ghz 8C 128GB RAM 480GB SSD 2x 10GBE
$297.00
2U 12 Bay SAS3 SuperMicro Server 6028U-TR4T+ W/ X10DRU-i+ Barebone 12 Caddy RAIL
$299.00
|
||
No Discussions have been posted on this vulnerability. |