MiracleLinux 3 : krb5-1.6.1-17AXS3.1 (AXSA:2008-345:03)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# Miracle Linux Security Advisory AXSA:2008-345:03.
##

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(284373);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/14");

  script_cve_id(
    "CVE-2007-0956",
    "CVE-2007-0957",
    "CVE-2007-1216",
    "CVE-2007-2442",
    "CVE-2007-2443",
    "CVE-2007-2798",
    "CVE-2007-3999",
    "CVE-2007-4000",
    "CVE-2007-5901",
    "CVE-2007-5971",
    "CVE-2008-0062",
    "CVE-2008-0063",
    "CVE-2008-0947"
  );
  script_xref(name:"IAVT", value:"2007-T-0025-S");
  script_xref(name:"IAVT", value:"2007-T-0037-S");
  script_xref(name:"IAVB", value:"2008-B-0024-S");
  script_xref(name:"IAVB", value:"2007-B-0012-S");

  script_name(english:"MiracleLinux 3 : krb5-1.6.1-17AXS3.1 (AXSA:2008-345:03)");

  script_set_attribute(attribute:"synopsis", value:
"The remote MiracleLinux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the
AXSA:2008-345:03 advisory.

    Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's
    security by eliminating the insecure practice of cleartext passwords.
    - add preliminary patch to fix use of uninitialized pointer / double-free in KDC
    (CVE-2008-0062,CVE-2008-0063)
    - add backported patch to fix use-after-free in libgssapi_krb5 (CVE-2007-5901)
    - add backported patch to fix double-free in libgssapi_krb5 (CVE-2007-5971)
    - add preliminary patch to fix incorrect handling of high-numbered descriptors in the RPC library
    (CVE-2008-0947)
    - fix storage of delegated krb5 credentials when they've been wrapped up in spnego
    - return a delegated credential handle even if the application didn't pass a location to store the flags
    which would be used to indicate that credentials were delegated
    - add patch to fall back to TCP kpasswd servers for kdc-unreachable, can't-resolve-server, and response-
    too-big errors
    - use the right sequence numbers when generating password-set/change requests for kpasswd servers after
    the first one
    - backport from 1.6.3 to initialize a library-allocated get_init_creds_opt structure the same way we would
    one which was allocated by the calling application, to restore kinit's traditional behavior of doing a
    password change right when it detects an expired password
    - ftpd: also do PAM session and credential management when ftp clients use strong authentication
    - update to revised patch for CVE-2007-3999
    - fix omission of files created by the db2 plugin when labeling
    - make krb5-workstation depend on the PAM configuration file used by login.krb5
    - fix omission of kadmin log file when labeling
    - add preliminary patch to fix buffer overflow in rpcsec_gss implementation in libgssrpc (CVE-2007-3999)
    and write through uninitialized pointer in kadmind (CVE-2007-4000)
    - kdc: default to listening for TCP clients as well
    - login: change to the user's home directory after dropping privileges, not before
    - turn off the ldap features
    - add a patch to allow applications to try to use a key with kvno=0, if found, in place of the right
    version for a request
    - incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443) and MITKRB5-SA-2007-005
    (CVE-2007-2798)
    - reintroduce missing %postun for the non-split_workstation case
    - add missing pam-devel build requirement, force selinux-or-fail build
    - label all files at creation-time according to the SELinux policy
    - perform PAM account / session management in krshd
    - perform PAM authentication and account / session management in ftpd
    - perform PAM authentication, account / session management, and password- changing in login.krb5
    - preprocess kerberos.ldif into a format FDS will like better, and include that as a doc file as well
    - switch man pages to being generated with the right paths in them
    - drop old, incomplete SELinux patch
    - add patch from Greg Hudson to make srvtab routines report missing-file errors at same point that keytab
    routines do
    - pull patch from svn to undo unintentional chattiness in ftp
    - pull patch from svn to handle NULL krb5_get_init_creds_opt structures better in a couple of places where
    they're expected
    - update to 1.6.1
    - drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
    - drop patch for sendto bug in 1.6, fixed in 1.6.1
    - kadmind.init: don't fail outright if the default principal database isn't there if it looks like we
    might be using the kldap plugin
    - kadmind.init: attempt to extract the key for the host-specific kadmin service when we try to create the
    keytab
    - omit dependent libraries from the krb5-config --libs output, as using shared libraries (no more static
    libraries) makes them unnecessary and they're not part of the libkrb5 interface (strips out libkeyutils,
    libresolv, libdl)
    - pull in keyutils as a build requirement to get the KEYRING: ccache type, because we've merged
    - fix an uninitialized length value which could cause a crash when parsing key data coming from a
    directory server
    - correct a typo in the krb5.conf man page (ldap_server->ldap_servers)
    - move the default acl_file, dict_file, and admin_keytab settings to the part of the default/example
    kdc.conf where they'll actually have an effect
    - add patch to correct unauthorized access via krb5-aware telnetdaemon (CVE-2007-0956)
    - add patch to fix buffer overflow in krb5kdc and kadmind(CVE-2007-0957)
    - add patch to fix double-free in kadmind (CVE-2007-1216)
    - back out buildrequires: keyutils-libs-devel for now
    - add buildrequires: on keyutils-libs-devel to enab

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://tsn.miraclelinux.com/en/node/443");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2008-0947");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2008-0062");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:"D2ExploitPack");
  script_set_attribute(attribute:"vendor_severity", value:"High");

  script_set_attribute(attribute:"vuln_publication_date", value:"2007/04/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2008/12/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:krb5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:krb5-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:krb5-server");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:miracle:linux:krb5-workstation");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:miracle:linux:3");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Miracle Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/MiracleLinux/release", "Host/MiracleLinux/rpm-list", "Host/cpu");

  exit(0);
}


include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'MIRACLE LINUX' >!< os_product) audit(AUDIT_OS_NOT, 'MIRACLE LINUX');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'MIRACLE LINUX');
if (! preg(pattern:"^3([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'MiracleLinux 3.x', 'MIRACLE LINUX ' + os_version);

if (!get_kb_item('Host/MiracleLinux/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'ppc' >!< cpu && 's390' >!< cpu && 'x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'MIRACLE LINUX', cpu);

var constraints = [
  {
    'release': '3',
    'pkgs': [
      {'reference':'krb5-devel-1.6.1-17AXS3.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'krb5-libs-1.6.1-17AXS3.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'krb5-server-1.6.1-17AXS3.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'},
      {'reference':'krb5-workstation-1.6.1-17AXS3.1', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE, 'epoch':'0'}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}
if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_HOLE,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'krb5-devel / krb5-libs / krb5-server / krb5-workstation');
}