|
Vulnerability Assessment & Network Security Forums |
|||||||||
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery. Home >> Browse Vulnerability Assessment Database >> Red Hat Local Security Checks >> RHSA-2003-052: krb Vulnerability Assessment Details
|
RHSA-2003-052: krb |
||
Check for the version of the krb packages Detailed Explanation for this Vulnerability Assessment Updated kerberos packages fix a number of vulnerabilities found in MIT Kerberos. Kerberos is a network authentication system. The MIT Kerberos team released an advisory describing a number of vulnerabilities that affect the kerberos packages shipped by Red Hat. An integer signedness error in the ASN.1 decoder before version 1.2.5 permits remote attackers to cause a denial of service via a large unsigned data element length, which is later used as a negative value. The Common Vulnerabilities and Exposures project has assigned the name CVE-2002-0036 to this issue. The Key Distribution Center (KDC) before version 1.2.5 permits remote, authenticated, attackers to cause a denial of service (crash) on KDCs within the same realm via a certain protocol request that: - causes a null pointer dereference (CVE-2003-0058). - causes the KDC to corrupt its heap (CVE-2003-0082). A vulnerability in Kerberos before version 1.2.3 permits users from one realm to impersonate users in other realms that have the same inter-realm keys (CVE-2003-0059). The MIT advisory for these issues also mentions format string vulnerabilities in the logging routines (CVE-2003-0060). Previous versions of the kerberos packages from Red Hat already contain fixes for this issue. Vulnerabilities have been found in the implementation of support for triple-DES keys in the implementation of the Kerberos IV authentication protocol included in MIT Kerberos (CVE-2003-0139). Vulnerabilities have been found in the Kerberos IV authentication protocol which permit a possible hacker with knowledge of a cross-realm key that is shared with another realm to impersonate any principal in that realm to any service in that realm. This vulnerability can only be closed by disabling cross-realm authentication in Kerberos IV (CVE-2003-0138). Vulnerabilities have been found in the RPC library used by the kadmin service in Kerberos 5. A faulty length check in the RPC library exposes kadmind to an integer overflow which can be used to crash kadmind (CVE-2003-0028). All users of Kerberos are advised to upgrade to these errata packages, which disable cross-realm authentication by default for Kerberos IV and which contain backported patches to correct these issues. Solution : http://rhn.redhat.com/errata/RHSA-2003-052.html Network Security Threat Level: High Networks Security ID: Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security |
||
Cables, Connectors |
Knoppix 9.1 Live Linux GNU Bootable USB Flash Drive USA
$14.77
$16.00
Knoppix Live GNU Linux System 9.1 on Bootable CD / DVD / USB Flash Drive
$9.99
$12.00
Linux Knoppix 4.0.2 Installation Disc
$39.99
Knoppix Linux Bootable OS v8.6 "Original Live Operating System" 16G USB Stick
$19.95
KNOPPIX 9.1 LINUX INSTALL & LIVE DVD
$9.99
Acer Aspire One 9 inch Netbook ZG5 512MB RAM 8GB SSD HD Knoppix Linux WiFi VGA
$79.99
Knoppix Linux Bootable OS v8.6 "Original Live Operating System" 32G USB Stick
$20.30
|
||
No Discussions have been posted on this vulnerability. |