Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.58924
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2007:0562
Summary:NOSUMMARY
Description:Description:

The remote host is missing updates announced in
advisory RHSA-2007:0562.

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other through use of symmetric encryption
and a trusted third party, the KDC. kadmind is the KADM5 administration
server.

David Coffey discovered an uninitialized pointer free flaw in the RPC
library used by kadmind. On Red Hat Enterprise Linux 4 and 5, glibc
detects attempts to free invalid pointers. A remote unauthenticated
attacker who can access kadmind could trigger this flaw and cause kadmind
to crash. (CVE-2007-2442)

David Coffey also discovered an overflow flaw in the RPC library used by
kadmind. On Red Hat Enterprise Linux, exploitation of this flaw is limited
to a denial of service. A remote unauthenticated attacker who can access
kadmind could trigger this flaw and cause kadmind to crash. (CVE-2007-2443)

A stack buffer overflow flaw was found in kadmind. An authenticated
attacker who can access kadmind could trigger this flaw and potentially
execute arbitrary code on the Kerberos server. (CVE-2007-2798)

Users of krb5-server are advised to update to these erratum packages which
contain backported fixes to correct these issues.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2007-0562.html
http://www.redhat.com/security/updates/classification/#important

Risk factor : Critical

CVSS Score:
9.3

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2007-2442
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
BugTraq ID: 24655
http://www.securityfocus.com/bid/24655
BugTraq ID: 25159
http://www.securityfocus.com/bid/25159
Bugtraq: 20070626 MITKRB5-SA-2007-004: kadmind multiple RPC lib vulnerabilities (Google Search)
http://www.securityfocus.com/archive/1/472288/100/0/threaded
Bugtraq: 20070628 FLEA-2007-0029-1: krb5 krb5-workstation (Google Search)
http://www.securityfocus.com/archive/1/472432/100/0/threaded
Bugtraq: 20070629 TSLSA-2007-0021 - kerberos5 (Google Search)
http://www.securityfocus.com/archive/1/472507/30/5970/threaded
Cert/CC Advisory: TA07-177A
http://www.us-cert.gov/cas/techalerts/TA07-177A.html
CERT/CC vulnerability note: VU#356961
http://www.kb.cert.org/vuls/id/356961
Debian Security Information: DSA-1323 (Google Search)
http://www.debian.org/security/2007/dsa-1323
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
http://security.gentoo.org/glsa/glsa-200707-11.xml
HPdes Security Advisory: HPSBUX02544
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02257427
HPdes Security Advisory: SSRT100107
http://www.mandriva.com/security/advisories?name=MDKSA-2007:137
http://osvdb.org/36596
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10631
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7344
http://www.redhat.com/support/errata/RHSA-2007-0384.html
http://www.redhat.com/support/errata/RHSA-2007-0562.html
http://www.securitytracker.com/id?1018293
http://secunia.com/advisories/25800
http://secunia.com/advisories/25801
http://secunia.com/advisories/25814
http://secunia.com/advisories/25821
http://secunia.com/advisories/25841
http://secunia.com/advisories/25870
http://secunia.com/advisories/25888
http://secunia.com/advisories/25890
http://secunia.com/advisories/25894
http://secunia.com/advisories/25911
http://secunia.com/advisories/26033
http://secunia.com/advisories/26228
http://secunia.com/advisories/26235
http://secunia.com/advisories/26909
http://secunia.com/advisories/27706
http://secunia.com/advisories/40346
SGI Security Advisory: 20070602-01-P
ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102914-1
SuSE Security Announcement: SUSE-SA:2007:038 (Google Search)
http://www.novell.com/linux/security/advisories/2007_38_krb5.html
http://www.trustix.org/errata/2007/0021/
http://www.ubuntu.com/usn/usn-477-1
http://www.vupen.com/english/advisories/2007/2337
http://www.vupen.com/english/advisories/2007/2354
http://www.vupen.com/english/advisories/2007/2491
http://www.vupen.com/english/advisories/2007/2732
http://www.vupen.com/english/advisories/2007/3229
http://www.vupen.com/english/advisories/2010/1574
XForce ISS Database: kerberos-gssrpcsvcauthgssapi-code-execution(35082)
https://exchange.xforce.ibmcloud.com/vulnerabilities/35082
Common Vulnerability Exposure (CVE) ID: CVE-2007-2443
BugTraq ID: 24657
http://www.securityfocus.com/bid/24657
CERT/CC vulnerability note: VU#365313
http://www.kb.cert.org/vuls/id/365313
http://osvdb.org/36597
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11277
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7131
XForce ISS Database: kerberos-gssrpcsvcauthunix-bo(35085)
https://exchange.xforce.ibmcloud.com/vulnerabilities/35085
Common Vulnerability Exposure (CVE) ID: CVE-2007-2798
BugTraq ID: 24653
http://www.securityfocus.com/bid/24653
Bugtraq: 20070626 MITKRB5-SA-2007-005: kadmind vulnerable to buffer overflow (Google Search)
http://www.securityfocus.com/archive/1/472289/100/0/threaded
CERT/CC vulnerability note: VU#554257
http://www.kb.cert.org/vuls/id/554257
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=548
http://osvdb.org/36595
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1726
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7550
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9996
http://www.securitytracker.com/id?1018295
http://secunia.com/advisories/25875
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102985-1
http://www.vupen.com/english/advisories/2007/2370
XForce ISS Database: kerberos-renameprincipal2svc-bo(35080)
https://exchange.xforce.ibmcloud.com/vulnerabilities/35080
CopyrightCopyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.