Test ID:	1.3.6.1.4.1.25623.1.0.123290
Category:	Oracle Linux Local Security Checks
Title:	Oracle: Security Advisory (ELSA-2014-1389)
Summary:	The remote host is missing an update for the 'krb5' package(s) announced via the ELSA-2014-1389 advisory.
Description:	Summary: The remote host is missing an update for the 'krb5' package(s) announced via the ELSA-2014-1389 advisory. Vulnerability Insight: [1.10.3-33] - actually apply that last patch [1.10.3-32] - incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345, #1128157) [1.10.3-31] - ksu: when evaluating .k5users, don't throw away data from .k5users when we're not passed a command to run, which implicitly means we're attempting to run the target user's shell (#1026721, revised) [1.10.3-30] - ksu: when evaluating .k5users, treat lines with just a principal name as if they contained the principal name followed by '*', and don't throw away data from .k5users when we're not passed a command to run, which implicitly means we're attempting to run the target user's shell (#1026721, revised) [1.10.3-29] - gssapi: pull in upstream fix for a possible NULL dereference in spnego (CVE-2014-4344, #1121510) - gssapi: pull in proposed-and-accepted fix for a double free in initiators (David Woodhouse, CVE-2014-4343, #1121510) [1.10.3-28] - correct a type mistake in the backported fix for CVE-2013-1418/CVE-2013-6800 [1.10.3-27] - pull in backported fix for denial of service by injection of malformed GSSAPI tokens (CVE-2014-4341, CVE-2014-4342, #1121510) - incorporate backported patch for remote crash of KDCs which serve multiple realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800, more of [1.10.3-26] - pull in backport of patch to not subsequently always require that responses come from master KDCs if we get one from a master somewhere along the way while chasing referrals (RT#7650, #1113652) [1.10.3-25] - ksu: if the -e flag isn't used, use the target user's shell when checking for authorization via the target user's .k5users file (#1026721) [1.10.3-24] - define _GNU_SOURCE in files where we use EAI_NODATA, to make sure that it's declared (#1059730) [1.10.3-23] - spnego: pull in patch from master to restore preserving the OID of the mechanism the initiator requested when we have multiple OIDs for the same mechanism, so that we reply using the same mechanism OID and the initiator doesn't get confused (#1087068, RT#7858) [1.10.3-22] - add patch from Jatin Nansi to avoid attempting to clear memory at the NULL address if krb5_encrypt_helper() returns an error when called from encrypt_credencpart() (#1055329, pull #158) [1.10.3-21] - drop patch to add additional access() checks to ksu - they shouldn't be resulting in any benefit [1.10.3-20] - apply patch from Nikolai Kondrashov to pass a default realm set in /etc/sysconfig/krb5kdc to the kdb_check_weak helper, so that it doesn't produce an error if there isn't one set in krb5.conf (#1009389) [1.10.3-19] - packaging: don't Obsoletes: older versions of krb5-pkinit-openssl and virtual Provide: krb5-pkinit-openssl on EL6, where we don't need to bother with any of that (#1001961) [1.10.3-18] - pkinit: backport tweaks to avoid trying to call the prompter callback when one isn't set (part of #965721) - pkinit: backport the ability to use a ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'krb5' package(s) on Oracle Linux 6. Solution: Please install the updated package(s). CVSS Score: 8.5 CVSS Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-1418 BugTraq ID: 63555 http://www.securityfocus.com/bid/63555 https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html SuSE Security Announcement: openSUSE-SU-2013:1738 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-11/msg00082.html SuSE Security Announcement: openSUSE-SU-2013:1751 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-11/msg00086.html SuSE Security Announcement: openSUSE-SU-2013:1833 (Google Search) http://lists.opensuse.org/opensuse-updates/2013-12/msg00026.html Common Vulnerability Exposure (CVE) ID: CVE-2013-6800 BugTraq ID: 63770 http://www.securityfocus.com/bid/63770 Common Vulnerability Exposure (CVE) ID: CVE-2014-4341 BugTraq ID: 68909 http://www.securityfocus.com/bid/68909 Debian Security Information: DSA-3000 (Google Search) http://www.debian.org/security/2014/dsa-3000 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136360.html http://security.gentoo.org/glsa/glsa-201412-53.xml http://www.mandriva.com/security/advisories?name=MDVSA-2014:165 RedHat Security Advisories: RHSA-2015:0439 http://rhn.redhat.com/errata/RHSA-2015-0439.html http://www.securitytracker.com/id/1030706 http://secunia.com/advisories/59102 http://secunia.com/advisories/60082 http://secunia.com/advisories/60448 XForce ISS Database: mit-kerberos-cve20144341-dos(94904) https://exchange.xforce.ibmcloud.com/vulnerabilities/94904 Common Vulnerability Exposure (CVE) ID: CVE-2014-4342 BugTraq ID: 68908 http://www.securityfocus.com/bid/68908 XForce ISS Database: mit-kerberos-cve20144342-dos(94903) https://exchange.xforce.ibmcloud.com/vulnerabilities/94903 Common Vulnerability Exposure (CVE) ID: CVE-2014-4343 BugTraq ID: 69159 http://www.securityfocus.com/bid/69159 http://www.osvdb.org/109390 http://secunia.com/advisories/61052 XForce ISS Database: kerberos-cve20144343-dos(95211) https://exchange.xforce.ibmcloud.com/vulnerabilities/95211 Common Vulnerability Exposure (CVE) ID: CVE-2014-4344 BugTraq ID: 69160 http://www.securityfocus.com/bid/69160 http://www.osvdb.org/109389 http://secunia.com/advisories/61051 XForce ISS Database: kerberos-cve20144344-dos(95210) https://exchange.xforce.ibmcloud.com/vulnerabilities/95210 Common Vulnerability Exposure (CVE) ID: CVE-2014-4345 BugTraq ID: 69168 http://www.securityfocus.com/bid/69168 http://lists.fedoraproject.org/pipermail/package-announce/2014-August/137056.html http://lists.fedoraproject.org/pipermail/package-announce/2014-August/136640.html http://www.osvdb.org/109908 RedHat Security Advisories: RHSA-2014:1255 http://rhn.redhat.com/errata/RHSA-2014-1255.html http://www.securitytracker.com/id/1030705 http://secunia.com/advisories/59415 http://secunia.com/advisories/59993 http://secunia.com/advisories/60535 http://secunia.com/advisories/60776 http://secunia.com/advisories/61314 http://secunia.com/advisories/61353 SuSE Security Announcement: SUSE-SU-2014:1028 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2014-08/msg00009.html SuSE Security Announcement: openSUSE-SU-2014:1043 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-08/msg00030.html XForce ISS Database: kerberos-cve20144345-bo(95212) https://exchange.xforce.ibmcloud.com/vulnerabilities/95212
Copyright	Copyright (C) 2015 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.