Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

NewStart CGSL MAIN 6.06 : krb5 Multiple Vulnerabilities (NS-SA-2025-0215)

🗓️ 30 Sep 2025 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 14 Views

NewStart CGSL MAIN 6.06 krb5 has multiple MIT Kerberos 5 flaws enabling remote code execution or DoS.

Related
Refs
Code
ReporterTitlePublishedViews
Family
veracode
Veracode		Denial Of Service (DoS)
13 Aug 201803:20
–veracode
veracode
Veracode		Denial Of Service (DoS)
13 Aug 201803:31
–veracode
veracode
Veracode		Denial Of Service (DoS)
13 Aug 201807:19
–veracode
veracode
Veracode		Denial Of Service (DoS)
15 Jan 201908:54
–veracode
veracode
Veracode		Denial Of Service
15 Jan 201909:01
–veracode
veracode
Veracode		Denial Of Service (DoS)
15 Jan 201909:01
–veracode
veracode
Veracode		Denial Of Service (DoS)
15 Jan 201909:05
–veracode
veracode
Veracode		Denial Of Service (DoS)
15 Jan 201909:11
–veracode
veracode
Veracode		Denial Of Service (DoS)
2 May 201904:42
–veracode
veracode
Veracode		Denial Of Service (DoS)
2 May 201905:04
–veracode
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from ZTE advisory NS-SA-2025-0215. The text
# itself is copyright (C) ZTE, Inc.
##

include('compat.inc');

if (description)
{
  script_id(266225);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/01");

  script_cve_id(
    "CVE-2002-2443",
    "CVE-2006-3084",
    "CVE-2006-6143",
    "CVE-2006-6144",
    "CVE-2007-0956",
    "CVE-2007-0957",
    "CVE-2007-1216",
    "CVE-2007-2442",
    "CVE-2007-2443",
    "CVE-2007-2798",
    "CVE-2007-3999",
    "CVE-2007-4000",
    "CVE-2007-4743",
    "CVE-2007-5901",
    "CVE-2007-5971",
    "CVE-2008-0062",
    "CVE-2008-0063",
    "CVE-2008-0947",
    "CVE-2009-0844",
    "CVE-2009-0845",
    "CVE-2009-0846",
    "CVE-2009-0847",
    "CVE-2009-3295",
    "CVE-2009-4212",
    "CVE-2010-0283",
    "CVE-2010-0628",
    "CVE-2010-1320",
    "CVE-2010-1321",
    "CVE-2010-1322",
    "CVE-2010-4022",
    "CVE-2011-0281",
    "CVE-2011-0282",
    "CVE-2011-0283",
    "CVE-2011-0284",
    "CVE-2011-0285",
    "CVE-2011-1527",
    "CVE-2011-1528",
    "CVE-2011-1529",
    "CVE-2011-1530",
    "CVE-2012-1012",
    "CVE-2012-1014",
    "CVE-2012-1015",
    "CVE-2013-1418",
    "CVE-2013-6800",
    "CVE-2014-4341",
    "CVE-2014-4342",
    "CVE-2014-4343",
    "CVE-2014-4344",
    "CVE-2014-4345",
    "CVE-2014-5351",
    "CVE-2014-5352",
    "CVE-2014-5353",
    "CVE-2014-5354",
    "CVE-2014-5355",
    "CVE-2014-9421",
    "CVE-2014-9422",
    "CVE-2014-9423",
    "CVE-2015-2694",
    "CVE-2015-2695",
    "CVE-2015-2696",
    "CVE-2015-2697",
    "CVE-2015-2698",
    "CVE-2015-8629",
    "CVE-2015-8630",
    "CVE-2015-8631",
    "CVE-2016-3119",
    "CVE-2016-3120",
    "CVE-2017-11368",
    "CVE-2017-11462",
    "CVE-2017-15088",
    "CVE-2018-5729",
    "CVE-2018-5730",
    "CVE-2020-28196"
  );
  script_xref(name:"CEA-ID", value:"CEA-2021-0025");

  script_name(english:"NewStart CGSL MAIN 6.06 : krb5 Multiple Vulnerabilities (NS-SA-2025-0215)");

  script_set_attribute(attribute:"synopsis", value:
"The remote NewStart CGSL host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The remote NewStart CGSL host, running version MAIN 6.06, has krb5 packages installed that are affected by multiple
vulnerabilities:

  - plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles
    Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial
    of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related
    to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use
    cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin
    code that is specific to Red Hat. (CVE-2017-15088)

  - The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT
    Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute
    arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error
    condition. (CVE-2011-0285)

  - schpw.c in the kpasswd service in kadmind in MIT Kerberos 5 (aka krb5) before 1.11.3 does not properly
    validate UDP packets before sending responses, which allows remote attackers to cause a denial of service
    (CPU and bandwidth consumption) via a forged packet that triggers a communication loop, as demonstrated by
    krb_pingpong.nasl, a related issue to CVE-1999-0103. (CVE-2002-2443)

  - The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to 1.5, and 1.4.x before 1.4.4, and (b)
    Heimdal 0.7.2 and earlier, do not check return codes for setuid calls, which might allow local users to
    gain privileges by causing setuid to fail to drop privileges. NOTE: as of 20060808, it is not known
    whether an exploitable attack scenario exists for these issues. (CVE-2006-3084)

  - The RPC library in Kerberos 5 1.4 through 1.4.4, and 1.5 through 1.5.1, as used in Kerberos administration
    daemon (kadmind) and other products that use this library, calls an uninitialized function pointer in
    freed memory, which allows remote attackers to cause a denial of service (crash) and possibly execute
    arbitrary code via unspecified vectors. (CVE-2006-6143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/notice/NS-SA-2025-0215");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2002-2443");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2006-3084");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2006-6143");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2006-6144");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-0956");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-0957");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-1216");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-2442");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-2443");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-2798");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-3999");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-4000");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-4743");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-5901");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2007-5971");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2008-0062");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2008-0063");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2008-0947");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2009-0844");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2009-0845");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2009-0846");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2009-0847");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2009-3295");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2009-4212");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-0283");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-0628");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-1320");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-1321");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-1322");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2010-4022");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-0281");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-0282");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-0283");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-0284");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-0285");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-1527");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-1528");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-1529");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2011-1530");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2012-1012");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2012-1014");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2012-1015");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2013-1418");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2013-6800");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-4341");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-4342");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-4343");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-4344");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-4345");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-5351");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-5352");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-5353");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-5354");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-5355");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-9421");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-9422");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2014-9423");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-2694");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-2695");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-2696");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-2697");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-2698");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-8629");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-8630");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2015-8631");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2016-3119");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2016-3120");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2017-11368");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2017-11462");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2017-15088");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2018-5729");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2018-5730");
  script_set_attribute(attribute:"see_also", value:"https://security.gd-linux.com/info/CVE-2020-28196");
  script_set_attribute(attribute:"solution", value:
"Upgrade the vulnerable CGSL krb5 packages. Note that updated packages may not be available yet. Please contact ZTE for
more information.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2011-0285");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2017-15088");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2006/08/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/30");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/30");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:krb5-devel");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:krb5-libs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:zte:cgsl_main:libkadm5");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:zte:cgsl_main:6");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"NewStart CGSL Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/ZTE-CGSL/release", "Host/ZTE-CGSL/rpm-list", "Host/cpu");

  exit(0);
}

include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var os_release = get_kb_item('Host/ZTE-CGSL/release');
if (isnull(os_release) || os_release !~ "^CGSL (MAIN|CORE)") audit(AUDIT_OS_NOT, 'NewStart Carrier Grade Server Linux');

if (os_release !~ "CGSL\sMAIN\s6\.06")
  audit(AUDIT_OS_NOT, 'NewStart CGSL MAIN 6.06');

if (!get_kb_item('Host/ZTE-CGSL/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'NewStart Carrier Grade Server Linux', cpu);

var flag = 0;

var pkgs = {
  'CGSL MAIN 6.06': [
    'krb5-devel-1.18.2-22.0.1.zncgsl6_7',
    'krb5-libs-1.18.2-22.0.1.zncgsl6_7',
    'libkadm5-1.18.2-22.0.1.zncgsl6_7'
  ]
};
var pkg_list = pkgs[os_release];
var pkg;
foreach (pkg in pkg_list)
  if (rpm_check(reference:pkg, release:'ZTE ' + os_release, rpm_spec_vers_cmp:TRUE)) flag++;

if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'krb5');
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
01 Oct 2025 00:00Current
7.4High risk
Vulners AI Score7.4
CVSS 210
CVSS 3.17.5 - 9.8
CVSS 39.8
EPSS0.40345
SSVC
mit kerberos fiveremote code executiondenial of servicekadmind password changesetuid privilege issue
14