Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.69198
Category:Red Hat Local Security Checks
Title:RedHat Security Advisory RHSA-2010:0925
Summary:NOSUMMARY
Description:Description:
The remote host is missing updates announced in
advisory RHSA-2010:0925.

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other using symmetric encryption and a
trusted third party, the Key Distribution Center (KDC).

Multiple checksum validation flaws were discovered in the MIT Kerberos
implementation. A remote attacker could use these flaws to tamper with
certain Kerberos protocol packets and, possibly, bypass authentication or
authorization mechanisms and escalate their privileges. (CVE-2010-1323,
CVE-2010-1324, CVE-2010-4020)

Red Hat would like to thank the MIT Kerberos Team for reporting these
issues.

This update also fixes the following bug:

* When attempting to perform PKINIT pre-authentication, if the client had
more than one possible candidate certificate the client could fail to
select the certificate and key to use. This usually occurred if certificate
selection was configured to use the value of the keyUsage extension, or if
any of the candidate certificates did not contain a subjectAltName
extension. Consequently, the client attempted to perform pre-authentication
using a different (usually password-based) mechanism. (BZ#644825)

All krb5 users should upgrade to these updated packages, which contain
backported patches to correct these issues. After installing the updated
packages, the krb5kdc daemon will be restarted automatically.

Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date

http://rhn.redhat.com/errata/RHSA-2010-0925.html
http://www.redhat.com/security/updates/classification/#important
http://web.mit.edu/Kerberos/advisories/MITKRB5-SA-2010-007.txt

Risk factor : Medium

CVSS Score:
4.3

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2010-1323
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
BugTraq ID: 45118
http://www.securityfocus.com/bid/45118
Bugtraq: 20101130 MITKRB5-SA-2010-007 Multiple checksum handling vulnerabilities [CVE-2010-1324 CVE-2010-1323 CVE-2010-4020 CVE-2010-4021] (Google Search)
http://www.securityfocus.com/archive/1/514953/100/0/threaded
Bugtraq: 20110428 VMSA-2011-0007 VMware ESXi and ESX Denial of Service and third party updates for Likewise components and ESX Service Console (Google Search)
http://www.securityfocus.com/archive/1/517739/100/0/threaded
Bugtraq: 20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console (Google Search)
http://www.securityfocus.com/archive/1/520102/100/0/threaded
Debian Security Information: DSA-2129 (Google Search)
http://www.debian.org/security/2010/dsa-2129
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051976.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051999.html
HPdes Security Advisory: HPSBOV02682
http://marc.info/?l=bugtraq&m=130497213107107&w=2
HPdes Security Advisory: HPSBUX02623
http://marc.info/?l=bugtraq&m=129562442714657&w=2
HPdes Security Advisory: SSRT100355
HPdes Security Advisory: SSRT100495
http://www.mandriva.com/security/advisories?name=MDVSA-2010:245
http://www.mandriva.com/security/advisories?name=MDVSA-2010:246
http://lists.vmware.com/pipermail/security-announce/2011/000133.html
http://osvdb.org/69610
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12121
http://www.redhat.com/support/errata/RHSA-2010-0925.html
http://www.redhat.com/support/errata/RHSA-2010-0926.html
http://www.securitytracker.com/id?1024803
http://secunia.com/advisories/42399
http://secunia.com/advisories/42420
http://secunia.com/advisories/42436
http://secunia.com/advisories/43015
http://secunia.com/advisories/46397
SuSE Security Announcement: SUSE-SR:2010:023 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
SuSE Security Announcement: SUSE-SR:2010:024 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
SuSE Security Announcement: SUSE-SU-2012:0010 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00002.html
SuSE Security Announcement: SUSE-SU-2012:0042 (Google Search)
http://lists.opensuse.org/opensuse-security-announce/2012-01/msg00010.html
http://www.ubuntu.com/usn/USN-1030-1
http://www.vupen.com/english/advisories/2010/3094
http://www.vupen.com/english/advisories/2010/3095
http://www.vupen.com/english/advisories/2010/3101
http://www.vupen.com/english/advisories/2010/3118
http://www.vupen.com/english/advisories/2011/0187
Common Vulnerability Exposure (CVE) ID: CVE-2010-1324
BugTraq ID: 45116
http://www.securityfocus.com/bid/45116
http://osvdb.org/69609
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11936
Common Vulnerability Exposure (CVE) ID: CVE-2010-4020
BugTraq ID: 45117
http://www.securityfocus.com/bid/45117
http://osvdb.org/69608
CopyrightCopyright (c) 2011 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.