Multiple vulnerabilities have been discovered in Heimdal, the worst of which could lead to remote code execution on a KDC.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 7.8.0-r1 | >= 7.8.0-r1 |
Heimdal is a free implementation of Kerberos 5.
Multiple vulnerabilities have been discovered in Heimdal, the worst of which could lead to remote code execution on a Kerberos Domain Controller. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Cross-realm trust vulnerability in Heimdal users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/heimdal-7.8.0-r1"
A boundary error in Heimdal could result in execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 1.5.1-r1 | >= 1.5.1-r1 |
Heimdal is a free implementation of Kerberos 5.
A boundary error in the "encrypt_keyid()" function in appl/telnet/libtelnet/encrypt.c of the telnet daemon and client could cause a buffer overflow.
An unauthenticated remote attacker may be able to execute arbitrary code with the privileges of the user running the telnet daemon or client, or cause Denial of Service.
There is no known workaround at this time.
All Heimdal users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/heimdal-1.5.1-r1"
Certain Heimdal components, ftpd and rcp, are vulnerable to a local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 0.7.2-r3 | >= 0.7.2-r3 |
Heimdal is a free implementation of Kerberos 5.
The ftpd and rcp applications provided by Heimdal fail to check the return value of calls to seteuid().
A local attacker could exploit this vulnerability to execute arbitrary code with elevated privileges.
There is no known workaround at this time.
All Heimdal users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/heimdal-0.7.2-r3"
An error in the rshd daemon of Heimdal could allow authenticated users to elevate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 0.7.2 | >= 0.7.2 |
Heimdal is a free implementation of Kerberos 5.
An unspecified privilege escalation vulnerability in the rshd server of Heimdal has been reported.
Authenticated users could exploit the vulnerability to escalate privileges or to change the ownership and content of arbitrary files.
There is no known workaround at this time.
All Heimdal users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/heimdal-0.7.2"
Multiple buffer overflow vulnerabilities in Heimdal's telnetd server could allow the execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 0.6.5 | >= 0.6.5 |
Heimdal is a free implementation of Kerberos 5 that includes a telnetd server.
It has been reported that the "getterminaltype" function of Heimdal's telnetd server is vulnerable to buffer overflows.
An attacker could exploit this vulnerability to execute arbitrary code with the permission of the telnetd server program.
There is no known workaround at this time.
All users should upgrade to the latest available version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/heimdal-0.6.5"
Buffer overflow vulnerabilities have been found in the telnet client in Heimdal which could lead to execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 0.6.4 | >= 0.6.4 |
Heimdal is a free implementation of Kerberos 5 that includes a telnet client program.
Buffer overflow vulnerabilities in the slc_add_reply() and env_opt_add() functions have been discovered by Gael Delalleau in the telnet client in Heimdal.
Successful exploitation would require a vulnerable user to connect to an attacker-controlled host using the telnet client, potentially executing arbitrary code with the permissions of the user running the application.
There is no known workaround at this time.
All Heimdal users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-crypt/heimdal-0.6.4"
Several bugs exist in the Heimdal ftp daemon which could allow a remote attacker to gain root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 0.6.3 | >= 0.6.3 |
Heimdal is an implementation of Kerberos 5.
Przemyslaw Frasunek discovered several flaws in lukemftpd, which also apply to Heimdal ftpd's out-of-band signal handling code.
Additionally, a potential vulnerability that could lead to Denial of Service by the Key Distribution Center (KDC) has been fixed in this version.
A remote attacker could be able to run arbitrary code with escalated privileges, which can result in a total compromise of the server.
There is no known workaround at this time.
All Heimdal users should upgrade to the latest version:
# emerge sync # emerge -pv ">=app-crypt/heimdal-0.6.3" # emerge ">=app-crypt/heimdal-0.6.3"
A possible buffer overflow in the Kerberos 4 component of Heimdal has been discovered.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | < 0.6.2 | >= 0.6.2 |
Heimdal is a free implementation of Kerberos.
A buffer overflow was discovered in kadmind, a server for administrative access to the Kerberos database.
By sending a specially formatted message to kadmind, a remote attacker may be able to crash kadmind causing a denial of service, or execute arbitrary code with the permissions of the kadmind process.
For a temporary workaround, providing you do not require Kerberos 4 support, you may turn off Kerberos 4 kadmin by running kadmind with the --no-kerberos4 option.
All Heimdal users should upgrade to the latest stable version:
# emerge sync # emerge -pv ">=app-crypt/heimdal-0.6.2" # emerge ">=app-crypt/heimdal-0.6.2"
Heimdal contains cross-realm vulnerability allowing someone with control over a realm to impersonate anyone in the cross-realm trust path.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-crypt/heimdal | * | <= 0.6.0 | >= 0.6.1 |
Heimdal is a free implementation of Kerberos 5.
Heimdal does not properly perform certain consistency checks for cross-realm requests, which allows remote attackers with control of a realm to impersonate others in the cross-realm trust path.
Remote attackers with control of a realm may be able to impersonate other users in the cross-realm trust path.
A workaround is not currently known for this issue. All users are advised to upgrade to the latest version of the affected package.
Heimdal users should upgrade to version 0.6.1 or later:
# emerge sync # emerge -pv ">=app-crypt/heimdal-0.6.1" # emerge ">=app-crypt/heimdal-0.6.1"