Vulnerabilities > CVE-2014-5355 - Denial of Service vulnerability in MIT Kerberos 5

#
# (C) Tenable Network Security, Inc.
#
# The package checks in this plugin were extracted from OracleVM
# Security Advisory OVMSA-2016-0039.
#

include("compat.inc");

if (description)
{
  script_id(90138);
  script_version("2.13");
  script_cvs_date("Date: 2019/09/27 13:00:35");

  script_cve_id("CVE-2014-5353", "CVE-2014-5355", "CVE-2015-8629", "CVE-2015-8631");
  script_bugtraq_id(71679, 74042);

  script_name(english:"OracleVM 3.3 / 3.4 : krb5 (OVMSA-2016-0039)");
  script_summary(english:"Checks the RPM output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote OracleVM host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote OracleVM system is missing necessary patches to address
critical security updates :

  - Fix (CVE-2015-8629, CVE-2015-8631)

  - Also fix a spec trigger issue that prevents building

  - Resolves: #1306973"
  );
  # https://oss.oracle.com/pipermail/oraclevm-errata/2016-March/000445.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e07cde0a"
  );
  # https://oss.oracle.com/pipermail/oraclevm-errata/2016-March/000450.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?ce35e9e3"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected krb5-libs package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:vm:krb5-libs");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:vm_server:3.3");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:vm_server:3.4");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2016/03/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2016/03/24");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"OracleVM Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/OracleVM/release", "Host/OracleVM/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/OracleVM/release");
if (isnull(release) || "OVS" >!< release) audit(AUDIT_OS_NOT, "OracleVM");
if (! preg(pattern:"^OVS" + "(3\.3|3\.4)" + "(\.[0-9]|$)", string:release)) audit(AUDIT_OS_NOT, "OracleVM 3.3 / 3.4", "OracleVM " + release);
if (!get_kb_item("Host/OracleVM/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "OracleVM", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);

flag = 0;
if (rpm_check(release:"OVS3.3", reference:"krb5-libs-1.10.3-42z1.el6_7")) flag++;

if (rpm_check(release:"OVS3.4", reference:"krb5-libs-1.10.3-42z1.el6_7")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "krb5-libs");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2015:2154 and 
# CentOS Errata and Security Advisory 2015:2154 respectively.
#

include("compat.inc");

if (description)
{
  script_id(87136);
  script_version("2.10");
  script_cvs_date("Date: 2020/01/02");

  script_cve_id("CVE-2014-5355", "CVE-2015-2694");
  script_xref(name:"RHSA", value:"2015:2154");

  script_name(english:"CentOS 7 : krb5 (CESA-2015:2154)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote CentOS host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated krb5 packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise
Linux 7.

Red Hat Product Security has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Kerberos is a network authentication system, which can improve the
security of your network by eliminating the insecure practice of
sending passwords over the network in unencrypted form. It allows
clients and servers to authenticate to each other with the help of a
trusted third party, the Kerberos key distribution center (KDC).

It was found that the krb5_read_message() function of MIT Kerberos did
not correctly sanitize input, and could create invalid krb5_data
objects. A remote, unauthenticated attacker could use this flaw to
crash a Kerberos child process via a specially crafted request.
(CVE-2014-5355)

A flaw was found in the OTP kdcpreauth module of MIT kerberos. An
unauthenticated remote attacker could use this flaw to bypass the
requires_preauth flag on a client principal and obtain a ciphertext
encrypted in the principal's long-term key. This ciphertext could be
used to conduct an off-line dictionary attack against the user's
password. (CVE-2015-2694)

The krb5 packages have been upgraded to upstream version 1.13.2, which
provides a number of bug fixes and enhancements over the previous
version. (BZ#1203889)

Notably, this update fixes the following bugs :

* Previously, the RADIUS support (libkrad) in krb5 was sending krb5
authentication for Transmission Control Protocol (TCP) transports
multiple times, accidentally using a code path intended to be used
only for unreliable transport types, for example User Datagram
Protocol (UDP) transports. A patch that fixes the problem by disabling
manual retries for reliable transports, such as TCP, has been applied,
and the correct code path is now used in this situation. (BZ#1251586)

* Attempts to use Kerberos single sign-on (SSO) to access SAP
NetWeaver systems sometimes failed. The SAP NetWeaver developer trace
displayed the following error message :

No credentials were supplied, or the credentials were unavailable or
inaccessible Unable to establish the security context

Querying SSO credential lifetime has been modified to trigger
credential acquisition, thus preventing the error from occurring. Now,
the user can successfully use Kerberos SSO for accessing SAP NetWeaver
systems. (BZ#1252454)

All krb5 users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements."
  );
  # https://lists.centos.org/pipermail/centos-cr-announce/2015-November/002350.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?88c2fe05"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected krb5 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2015-2694");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:krb5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:krb5-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:krb5-pkinit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:krb5-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:krb5-server-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:krb5-workstation");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:centos:centos:7");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/02/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/11/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/12/02");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"CentOS Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/CentOS/release");
if (isnull(release) || "CentOS" >!< release) audit(AUDIT_OS_NOT, "CentOS");
os_ver = pregmatch(pattern: "CentOS(?: Linux)? release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "CentOS");
os_ver = os_ver[1];
if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "CentOS 7.x", "CentOS " + os_ver);

if (!get_kb_item("Host/CentOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "CentOS", cpu);


flag = 0;
if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"krb5-devel-1.13.2-10.el7")) flag++;
if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"krb5-libs-1.13.2-10.el7")) flag++;
if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"krb5-pkinit-1.13.2-10.el7")) flag++;
if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"krb5-server-1.13.2-10.el7")) flag++;
if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"krb5-server-ldap-1.13.2-10.el7")) flag++;
if (rpm_check(release:"CentOS-7", cpu:"x86_64", reference:"krb5-workstation-1.13.2-10.el7")) flag++;


if (flag)
{
  cr_plugin_caveat = '\n' +
    'NOTE: The security advisory associated with this vulnerability has a\n' +
    'fixed package version that may only be available in the continuous\n' +
    'release (CR) repository for CentOS, until it is present in the next\n' +
    'point release of CentOS.\n\n' +

    'If an equal or higher package level does not exist in the baseline\n' +
    'repository for your major version of CentOS, then updates from the CR\n' +
    'repository will need to be applied in order to address the\n' +
    'vulnerability.\n';
  security_report_v4(
    port       : 0,
    severity   : SECURITY_WARNING,
    extra      : rpm_report_get() + cr_plugin_caveat
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-2810-1. The text 
# itself is copyright (C) Canonical, Inc. See 
# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
# trademark of Canonical, Inc.
#

include("compat.inc");

if (description)
{
  script_id(86872);
  script_version("2.13");
  script_cvs_date("Date: 2019/09/18 12:31:45");

  script_cve_id("CVE-2002-2443", "CVE-2014-5355", "CVE-2015-2694", "CVE-2015-2695", "CVE-2015-2696", "CVE-2015-2697", "CVE-2015-2698");
  script_xref(name:"USN", value:"2810-1");

  script_name(english:"Ubuntu 12.04 LTS / 14.04 LTS / 15.04 / 15.10 : krb5 vulnerabilities (USN-2810-1)");
  script_summary(english:"Checks dpkg output for updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Ubuntu host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that the Kerberos kpasswd service incorrectly
handled certain UDP packets. A remote attacker could possibly use this
issue to cause resource consumption, resulting in a denial of service.
This issue only affected Ubuntu 12.04 LTS. (CVE-2002-2443)

It was discovered that Kerberos incorrectly handled null bytes in
certain data fields. A remote attacker could possibly use this issue
to cause a denial of service. This issue only affected Ubuntu 12.04
LTS and Ubuntu 14.04 LTS. (CVE-2014-5355)

It was discovered that the Kerberos kdcpreauth modules incorrectly
tracked certain client requests. A remote attacker could possibly use
this issue to bypass intended preauthentication requirements. This
issue only affected Ubuntu 14.04 LTS and Ubuntu 15.04. (CVE-2015-2694)

It was discovered that Kerberos incorrectly handled certain SPNEGO
packets. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2015-2695)

It was discovered that Kerberos incorrectly handled certain IAKERB
packets. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2015-2696, CVE-2015-2698)

It was discovered that Kerberos incorrectly handled certain TGS
requests. A remote attacker could possibly use this issue to cause a
denial of service. (CVE-2015-2697).

Note that Tenable Network Security has extracted the preceding
description block directly from the Ubuntu security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://usn.ubuntu.com/2810-1/"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:krb5-admin-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:krb5-k5tls");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:krb5-kdc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:krb5-kdc-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:krb5-otp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:krb5-pkinit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:krb5-user");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libgssapi-krb5-2");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libgssrpc4");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libk5crypto3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkadm5clnt-mit8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkadm5clnt-mit9");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkdb5-6");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkdb5-7");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkdb5-8");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkrad0");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkrb5-3");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkrb53");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libkrb5support0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:12.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:14.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:15.04");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:15.10");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/05/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/11/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/13");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"Ubuntu Security Notice (C) 2015-2019 Canonical, Inc. / NASL script (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Ubuntu Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("ubuntu.inc");
include("misc_func.inc");

if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/Ubuntu/release");
if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
release = chomp(release);
if (! preg(pattern:"^(12\.04|14\.04|15\.04|15\.10)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 12.04 / 14.04 / 15.04 / 15.10", "Ubuntu " + release);
if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);

flag = 0;

if (ubuntu_check(osver:"12.04", pkgname:"krb5-admin-server", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"krb5-kdc", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"krb5-kdc-ldap", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"krb5-pkinit", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"krb5-user", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libgssapi-krb5-2", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libgssrpc4", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libk5crypto3", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libkadm5clnt-mit8", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libkdb5-6", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libkrb5-3", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libkrb53", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"12.04", pkgname:"libkrb5support0", pkgver:"1.10+dfsg~beta1-2ubuntu0.7")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"krb5-admin-server", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"krb5-kdc", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"krb5-kdc-ldap", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"krb5-otp", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"krb5-pkinit", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"krb5-user", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libgssapi-krb5-2", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libgssrpc4", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libk5crypto3", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libkadm5clnt-mit9", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libkdb5-7", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libkrad0", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libkrb5-3", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"14.04", pkgname:"libkrb5support0", pkgver:"1.12+dfsg-2ubuntu5.2")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"krb5-admin-server", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"krb5-kdc", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"krb5-kdc-ldap", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"krb5-otp", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"krb5-pkinit", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"krb5-user", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libgssapi-krb5-2", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libgssrpc4", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libk5crypto3", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libkadm5clnt-mit9", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libkdb5-7", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libkrad0", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libkrb5-3", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.04", pkgname:"libkrb5support0", pkgver:"1.12.1+dfsg-18ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"krb5-admin-server", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"krb5-k5tls", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"krb5-kdc", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"krb5-kdc-ldap", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"krb5-otp", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"krb5-pkinit", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"krb5-user", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libgssapi-krb5-2", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libgssrpc4", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libk5crypto3", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libkadm5clnt-mit9", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libkdb5-8", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libkrad0", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libkrb5-3", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;
if (ubuntu_check(osver:"15.10", pkgname:"libkrb5support0", pkgver:"1.13.2+dfsg-2ubuntu0.1")) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : ubuntu_report_get()
  );
  exit(0);
}
else
{
  tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "krb5-admin-server / krb5-k5tls / krb5-kdc / krb5-kdc-ldap / etc");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from SUSE update advisory SUSE-SU-2015:1276-1.
# The text itself is copyright (C) SUSE.
#

include("compat.inc");

if (description)
{
  script_id(84914);
  script_version("2.13");
  script_cvs_date("Date: 2019/09/11 11:22:12");

  script_cve_id("CVE-2014-5353", "CVE-2014-5354", "CVE-2014-5355", "CVE-2015-2694");
  script_bugtraq_id(71679, 71680, 74042, 74824);

  script_name(english:"SUSE SLES12 Security Update : krb5 (SUSE-SU-2015:1276-1)");
  script_summary(english:"Checks rpm output for the updated packages.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote SUSE host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"krb5 was updated to fix four security issues.

These security issues were fixed :

  - CVE-2014-5353: NULL pointer dereference when using a
    ticket policy name as password name (bsc#910457).

  - CVE-2014-5354: NULL pointer dereference when using
    keyless entries (bsc#910458).

  - CVE-2014-5355: Denial of service in krb5_read_message
    (bsc#918595).

  - CVE-2015-2694: OTP and PKINIT kdcpreauth modules leading
    to requires_preauth bypass (bsc#928978).

Note that Tenable Network Security has extracted the preceding
description block directly from the SUSE security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=910457"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=910458"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=918595"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.suse.com/show_bug.cgi?id=928978"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2014-5353/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2014-5354/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2014-5355/"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.suse.com/security/cve/CVE-2015-2694/"
  );
  # https://www.suse.com/support/update/announcement/2015/suse-su-20151276-1.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?e834cd3a"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product :

SUSE Linux Enterprise Software Development Kit 12 :

zypper in -t patch SUSE-SLE-SDK-12-2015-335=1

SUSE Linux Enterprise Server 12 :

zypper in -t patch SUSE-SLE-SERVER-12-2015-335=1

To bring your system up-to-date, use 'zypper patch'."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-client");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-client-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-debugsource");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-doc");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-plugin-kdb-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-plugin-kdb-ldap-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-plugin-preauth-otp");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-plugin-preauth-otp-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-plugin-preauth-pkinit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-plugin-preauth-pkinit-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:krb5-server-debuginfo");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");

  script_set_attribute(attribute:"vuln_publication_date", value:"2014/12/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/07/22");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"SuSE Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/SuSE/release");
if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
os_ver = os_ver[1];
if (! preg(pattern:"^(SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLES12", "SUSE " + os_ver);

if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);

sp = get_kb_item("Host/SuSE/patchlevel");
if (isnull(sp)) sp = "0";
if (os_ver == "SLES12" && (! preg(pattern:"^(0)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP0", os_ver + " SP" + sp);


flag = 0;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-client-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-client-debuginfo-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-debuginfo-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-debugsource-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-doc-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-plugin-kdb-ldap-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-plugin-kdb-ldap-debuginfo-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-plugin-preauth-otp-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-plugin-preauth-otp-debuginfo-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-plugin-preauth-pkinit-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-plugin-preauth-pkinit-debuginfo-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-server-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-server-debuginfo-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-32bit-1.12.1-16.1")) flag++;
if (rpm_check(release:"SLES12", sp:"0", reference:"krb5-debuginfo-32bit-1.12.1-16.1")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "krb5");
}

#
# (C) Tenable Network Security, Inc.
#
# The text in the description was extracted from AIX Security
# Advisory nas_advisory3.asc.
#

include("compat.inc");

if (description)
{
  script_id(83874);
  script_version("1.9");
  script_cvs_date("Date: 2018/07/17 12:00:06");

  script_cve_id(
    "CVE-2014-5352",
    "CVE-2014-5355",
    "CVE-2014-9421",
    "CVE-2014-9422",
    "CVE-2014-9423"
  );
  script_bugtraq_id(
    72494,
    72495,
    72496,
    72503,
    74042
  );

  script_name(english:"AIX NAS Advisory : nas_advisory3.asc");
  script_summary(english:"Checks the version of the krb5 packages.");

  script_set_attribute(attribute:"synopsis", value:
"The remote AIX host has a version of NAS installed that is affected by
multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of the Network Authentication Service (NAS) installed on
the remote AIX host is affected by the following vulnerabilities
related to Kerberos 5 :

  - Denial of service and remote code execution
    vulnerabilities exist due to security context handles
    not being properly maintained, allowing an
    authenticated, remote attacker to crash the service or
    execute arbitrary code using crafted GSSAPI traffic.
    (CVE-2014-5352)

  - A denial of service vulnerability exists due to improper
    handling of zero-byte or unterminated strings.
    (CVE-2014-5355)

  - Denial of service and remote code execution
    vulnerabilities exist which allow an authenticated,
    remote attacker to crash the service or execute
    arbitrary code using crafted, malformed XDR data.
    (CVE-2014-9421)

  - A privilege escalation vulnerability exists that allows
    an authenticated, remote attacker to gain administrative
    access via a flaw in kadmin authorization checks.
    (CVE-2014-9422)

  - An information disclosure vulnerability allows an
    attacker to gain information about process heap memory
    from NAS packets. (CVE-2014-9423)");
  script_set_attribute(attribute:"see_also", value:"http://aix.software.ibm.com/aix/efixes/security/nas_advisory3.asc");
  script_set_attribute(attribute:"solution", value:
"Fixes are available at the 1.5.0.7 and 1.6.0.2 levels of the software
and can be downloaded from the AIX website.

For the NAS fileset level 1.5.0.7,
 apply ifix 1507c_fix.150404.epkg.Z if only krb5.client.rte is
 installed, otherwise apply 1507s_fix.150407.epkg.Z if krb5.server.rte
 is installed.

For the NAS fileset level 1.6.0.2,
 apply ifix 1602c_fix.150404.epkg.Z if only krb5.client.rte is
 installed, otherwise apply 1602s_fix.150407.epkg.Z if krb5.server.rte
 is installed.

For the NAS fileset level 1.5.0.3-1.5.0.4,
 upgrade to NAS fileset level 1.6.0.2 and apply ifix
 1602c_fix.150404.epkg.Z if only krb5.client.rte is installed,
 otherwise apply 1602s_fix.150407.epkg.Z if krb5.server.rte is
 installed.

For all other NAS fileset levels,
 upgrade to NAS fileset level 1.5.0.7 and apply ifix
 1507c_fix.150404.epkg.Z if only krb5.client.rte is installed,
 otherwise apply 1507s_fix.150407.epkg.Z if krb5.server.rte is
 installed.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:ibm:aix");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:mit:kerberos");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/02/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/05/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/28");

  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
  script_family(english:"AIX Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/AIX/lslpp", "Host/local_checks_enabled", "Host/AIX/version");

  exit(0);
}

include("aix.inc");
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/AIX/version")) audit(AUDIT_OS_NOT, "AIX");
if (!get_kb_item("Host/AIX/lslpp")) audit(AUDIT_PACKAGE_LIST_MISSING);

if (get_kb_item("Host/AIX/emgr_failure")) exit(0, "This AIX package check is disabled because : "+get_kb_item("Host/AIX/emgr_failure") );

flag = 0;

# 1.5.0.7, 1.6.0.2
# Check for server existence first then ifixes on latest clients
if (
  aix_check_package(release:"5.3", package:"krb5.server.rte", minpackagever:"0.0.0.0", maxpackagever:"1.6.0.2") > 0 ||
  aix_check_package(release:"6.1", package:"krb5.server.rte", minpackagever:"0.0.0.0", maxpackagever:"1.6.0.2") > 0 ||
  aix_check_package(release:"7.1", package:"krb5.server.rte", minpackagever:"0.0.0.0", maxpackagever:"1.6.0.2") > 0
)
{
  # Client checks with server
  if (aix_check_ifix(release:"5.3", patch:"1507s_fix", package:"krb5.client.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
  if (aix_check_ifix(release:"6.1", patch:"1507s_fix", package:"krb5.client.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
  if (aix_check_ifix(release:"7.1", patch:"1507s_fix", package:"krb5.client.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
  if (aix_check_ifix(release:"5.3", patch:"1602s_fix", package:"krb5.client.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;
  if (aix_check_ifix(release:"6.1", patch:"1602s_fix", package:"krb5.client.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;
  if (aix_check_ifix(release:"7.1", patch:"1602s_fix", package:"krb5.client.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;

}
else
{
  if (aix_check_ifix(release:"5.3", patch:"1507c_fix", package:"krb5.client.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
  if (aix_check_ifix(release:"6.1", patch:"1507c_fix", package:"krb5.client.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
  if (aix_check_ifix(release:"7.1", patch:"1507c_fix", package:"krb5.client.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
  if (aix_check_ifix(release:"5.3", patch:"1602c_fix", package:"krb5.client.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;
  if (aix_check_ifix(release:"6.1", patch:"1602c_fix", package:"krb5.client.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;
  if (aix_check_ifix(release:"7.1", patch:"1602c_fix", package:"krb5.client.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;
}

# ifix checks on latest servers
if (aix_check_ifix(release:"5.3", patch:"1507s_fix", package:"krb5.server.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
if (aix_check_ifix(release:"6.1", patch:"1507s_fix", package:"krb5.server.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
if (aix_check_ifix(release:"7.1", patch:"1507s_fix", package:"krb5.server.rte", minfilesetver:"1.5.0.7", maxfilesetver:"1.5.0.7") < 0) flag++;
if (aix_check_ifix(release:"5.3", patch:"1602s_fix", package:"krb5.server.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;
if (aix_check_ifix(release:"6.1", patch:"1602s_fix", package:"krb5.server.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;
if (aix_check_ifix(release:"7.1", patch:"1602s_fix", package:"krb5.server.rte", minfilesetver:"1.6.0.2", maxfilesetver:"1.6.0.2") < 0) flag++;

# All other versions, package checks
# Below 1.5.0.3
if (aix_check_package(release:"5.3", package:"krb5.server.rte", minpackagever:"0.0.0.0", maxpackagever:"1.5.0.2", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.server.rte", minpackagever:"0.0.0.0", maxpackagever:"1.5.0.2", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.server.rte", minpackagever:"0.0.0.0", maxpackagever:"1.5.0.2", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"5.3", package:"krb5.client.rte", minpackagever:"0.0.0.0", maxpackagever:"1.5.0.2", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.client.rte", minpackagever:"0.0.0.0", maxpackagever:"1.5.0.2", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.client.rte", minpackagever:"0.0.0.0", maxpackagever:"1.5.0.2", fixpackagever:"1.5.0.7") > 0) flag++;
# 1.5.0.5 - 1.5.0.6
if (aix_check_package(release:"5.3", package:"krb5.server.rte", minpackagever:"1.5.0.5", maxpackagever:"1.5.0.6", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.server.rte", minpackagever:"1.5.0.5", maxpackagever:"1.5.0.6", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.server.rte", minpackagever:"1.5.0.5", maxpackagever:"1.5.0.6", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"5.3", package:"krb5.client.rte", minpackagever:"1.5.0.5", maxpackagever:"1.5.0.6", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.client.rte", minpackagever:"1.5.0.5", maxpackagever:"1.5.0.6", fixpackagever:"1.5.0.7") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.client.rte", minpackagever:"1.5.0.5", maxpackagever:"1.5.0.6", fixpackagever:"1.5.0.7") > 0) flag++;
# 1.5.0.3 - 1.5.0.4
if (aix_check_package(release:"5.3", package:"krb5.server.rte", minpackagever:"1.5.0.3", maxpackagever:"1.5.0.4", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.server.rte", minpackagever:"1.5.0.3", maxpackagever:"1.5.0.4", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.server.rte", minpackagever:"1.5.0.3", maxpackagever:"1.5.0.4", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"5.3", package:"krb5.client.rte", minpackagever:"1.5.0.3", maxpackagever:"1.5.0.4", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.client.rte", minpackagever:"1.5.0.3", maxpackagever:"1.5.0.4", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.client.rte", minpackagever:"1.5.0.3", maxpackagever:"1.5.0.4", fixpackagever:"1.6.0.2") > 0) flag++;
# 1.6.0.0 - 1.6.0.1
if (aix_check_package(release:"5.3", package:"krb5.server.rte", minpackagever:"1.6.0.0", maxpackagever:"1.6.0.1", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.server.rte", minpackagever:"1.6.0.0", maxpackagever:"1.6.0.1", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.server.rte", minpackagever:"1.6.0.0", maxpackagever:"1.6.0.1", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"5.3", package:"krb5.client.rte", minpackagever:"1.6.0.0", maxpackagever:"1.6.0.1", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"6.1", package:"krb5.client.rte", minpackagever:"1.6.0.0", maxpackagever:"1.6.0.1", fixpackagever:"1.6.0.2") > 0) flag++;
if (aix_check_package(release:"7.1", package:"krb5.client.rte", minpackagever:"1.6.0.0", maxpackagever:"1.6.0.1", fixpackagever:"1.6.0.2") > 0) flag++;


report_note = '\n' +
  'NOTE: See solution for additional ifix patching instructions if' + '\n' +
  'fileset level is not 1.5.0.7 or 1.6.0.2.' + '\n';

if (flag)
{
  report_extra = aix_report_get() + report_note;
  if (report_verbosity > 0) security_hole(port:0, extra:report_extra);
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Red Hat Security Advisory RHSA-2015:2154 and 
# Oracle Linux Security Advisory ELSA-2015-2154 respectively.
#

include("compat.inc");

if (description)
{
  script_id(87026);
  script_version("1.12");
  script_cvs_date("Date: 2019/09/27 13:00:36");

  script_cve_id("CVE-2014-5355", "CVE-2015-2694");
  script_xref(name:"RHSA", value:"2015:2154");

  script_name(english:"Oracle Linux 7 : krb5 (ELSA-2015-2154)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Oracle Linux host is missing one or more security updates."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"From Red Hat Security Advisory 2015:2154 :

Updated krb5 packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise
Linux 7.

Red Hat Product Security has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Kerberos is a network authentication system, which can improve the
security of your network by eliminating the insecure practice of
sending passwords over the network in unencrypted form. It allows
clients and servers to authenticate to each other with the help of a
trusted third party, the Kerberos key distribution center (KDC).

It was found that the krb5_read_message() function of MIT Kerberos did
not correctly sanitize input, and could create invalid krb5_data
objects. A remote, unauthenticated attacker could use this flaw to
crash a Kerberos child process via a specially crafted request.
(CVE-2014-5355)

A flaw was found in the OTP kdcpreauth module of MIT kerberos. An
unauthenticated remote attacker could use this flaw to bypass the
requires_preauth flag on a client principal and obtain a ciphertext
encrypted in the principal's long-term key. This ciphertext could be
used to conduct an off-line dictionary attack against the user's
password. (CVE-2015-2694)

The krb5 packages have been upgraded to upstream version 1.13.2, which
provides a number of bug fixes and enhancements over the previous
version. (BZ#1203889)

Notably, this update fixes the following bugs :

* Previously, the RADIUS support (libkrad) in krb5 was sending krb5
authentication for Transmission Control Protocol (TCP) transports
multiple times, accidentally using a code path intended to be used
only for unreliable transport types, for example User Datagram
Protocol (UDP) transports. A patch that fixes the problem by disabling
manual retries for reliable transports, such as TCP, has been applied,
and the correct code path is now used in this situation. (BZ#1251586)

* Attempts to use Kerberos single sign-on (SSO) to access SAP
NetWeaver systems sometimes failed. The SAP NetWeaver developer trace
displayed the following error message :

No credentials were supplied, or the credentials were unavailable or
inaccessible Unable to establish the security context

Querying SSO credential lifetime has been modified to trigger
credential acquisition, thus preventing the error from occurring. Now,
the user can successfully use Kerberos SSO for accessing SAP NetWeaver
systems. (BZ#1252454)

All krb5 users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://oss.oracle.com/pipermail/el-errata/2015-November/005557.html"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected krb5 packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:krb5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:krb5-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:krb5-pkinit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:krb5-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:krb5-server-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:oracle:linux:krb5-workstation");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:oracle:linux:7");

  script_set_attribute(attribute:"vuln_publication_date", value:"2015/02/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2015/11/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/11/24");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Oracle Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/OracleLinux", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/OracleLinux")) audit(AUDIT_OS_NOT, "Oracle Linux");
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || !pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux)", string:release)) audit(AUDIT_OS_NOT, "Oracle Linux");
os_ver = pregmatch(pattern: "Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Oracle Linux");
os_ver = os_ver[1];
if (! preg(pattern:"^7([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Oracle Linux 7", "Oracle Linux " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Oracle Linux", cpu);
if ("x86_64" >!< cpu) audit(AUDIT_ARCH_NOT, "x86_64", cpu);

flag = 0;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"krb5-devel-1.13.2-10.el7")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"krb5-libs-1.13.2-10.el7")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"krb5-pkinit-1.13.2-10.el7")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"krb5-server-1.13.2-10.el7")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"krb5-server-ldap-1.13.2-10.el7")) flag++;
if (rpm_check(release:"EL7", cpu:"x86_64", reference:"krb5-workstation-1.13.2-10.el7")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc");
}

#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Amazon Linux AMI Security Advisory ALAS-2015-518.
#

include("compat.inc");

if (description)
{
  script_id(83269);
  script_version("1.6");
  script_cvs_date("Date: 2018/04/18 15:09:35");

  script_cve_id("CVE-2014-5352", "CVE-2014-5353", "CVE-2014-5355", "CVE-2014-9421", "CVE-2014-9422");
  script_xref(name:"ALAS", value:"2015-518");
  script_xref(name:"RHSA", value:"2015:0794");

  script_name(english:"Amazon Linux AMI : krb5 (ALAS-2015-518)");
  script_summary(english:"Checks rpm output for the updated packages");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Amazon Linux AMI host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"A use-after-free flaw was found in the way the MIT Kerberos
libgssapi_krb5 library processed valid context deletion tokens. An
attacker able to make an application using the GSS-API library
(libgssapi) could call the gss_process_context_token() function and
use this flaw to crash that application. (CVE-2014-5352)

If kadmind were used with an LDAP back end for the KDC database, a
remote, authenticated attacker who has the permissions to set the
password policy could crash kadmind by attempting to use a named
ticket policy object as a password policy for a principal.
(CVE-2014-5353)

It was found that the krb5_read_message() function of MIT Kerberos did
not correctly sanitize input, and could create invalid krb5_data
objects. A remote, unauthenticated attacker could use this flaw to
crash a Kerberos child process via a specially crafted request.
(CVE-2014-5355)

A double-free flaw was found in the way MIT Kerberos handled invalid
External Data Representation (XDR) data. An authenticated user could
use this flaw to crash the MIT Kerberos administration server
(kadmind), or other applications using Kerberos libraries, via
specially crafted XDR packets. (CVE-2014-9421)

It was found that the MIT Kerberos administration server (kadmind)
incorrectly accepted certain authentication requests for two-component
server principal names. A remote attacker able to acquire a key with a
particularly named principal (such as 'kad/x') could use this flaw to
impersonate any user to kadmind, and perform administrative actions as
that user. (CVE-2014-9422)"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://alas.aws.amazon.com/ALAS-2015-518.html"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Run 'yum update krb5' to update your system."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:krb5-debuginfo");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:krb5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:krb5-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:krb5-pkinit-openssl");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:krb5-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:krb5-server-ldap");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:amazon:linux:krb5-workstation");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:amazon:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2015/05/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2015/05/07");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2015-2018 Tenable Network Security, Inc.");
  script_family(english:"Amazon Linux Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/AmazonLinux/release", "Host/AmazonLinux/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

release = get_kb_item("Host/AmazonLinux/release");
if (isnull(release) || !strlen(release)) audit(AUDIT_OS_NOT, "Amazon Linux");
os_ver = pregmatch(pattern: "^AL(A|\d)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Amazon Linux");
os_ver = os_ver[1];
if (os_ver != "A")
{
  if (os_ver == 'A') os_ver = 'AMI';
  audit(AUDIT_OS_NOT, "Amazon Linux AMI", "Amazon Linux " + os_ver);
}

if (!get_kb_item("Host/AmazonLinux/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (rpm_check(release:"ALA", reference:"krb5-debuginfo-1.10.3-37.29.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"krb5-devel-1.10.3-37.29.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"krb5-libs-1.10.3-37.29.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"krb5-pkinit-openssl-1.10.3-37.29.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"krb5-server-1.10.3-37.29.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"krb5-server-ldap-1.10.3-37.29.amzn1")) flag++;
if (rpm_check(release:"ALA", reference:"krb5-workstation-1.10.3-37.29.amzn1")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "krb5-debuginfo / krb5-devel / krb5-libs / krb5-pkinit-openssl / etc");
}