APP: Kerberos Zero-Length GSS Token

This signature detects attempts to exploit a known vulnerability against Kerberos Administration Server (kadmind) version 5-1.6.1 and earlier. A successful attack can lead to arbitrary code execution.

Extended Description

MIT Kerberos 5 Administration Daemon ('kadmind') is prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code with superuser privileges, completely compromising affected computers. Failed exploit attempts will likely result in denial-of-service conditions. All 'kadmind' servers run on the master Kerberos server. Since the master server holds the KDC principal and policy database, an attack may not only compromise the affected computer, but could also compromise multiple hosts that use the server for authentication. This issue also affects third-party applications using the affected RPC library. Versions prior to 'kadmind' krb5-1.6.1 are vulnerable.

Affected Products

Vmware esx_server

References

BugTraq: 24655

CVE: CVE-2007-2442

URL: http://www.kb.cert.org/vuls/id/356961 http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2007-004.txt

Short Name

APP:KERBEROS:GSS-ZERO-TOKEN

Severity

Critical

Recommended

False

Recommended Action

Drop

APP: Kerberos Zero-Length GSS Token

Extended Description

Affected Products

References

Found a potential security threat?