Date: Thu, 06 Sep 2007 14:03:58 -0600
From: [email protected]Subject: [ MDKSA-2007:174 ] - Updated krb5 packages fix vulnerabilities
To: [email protected]
Reply-To: [email protected]
Message-id: <E1ITNa2-0005Jo-JK@artemis.annvix.ca.>
X-SA-Exim-Connect-IP: 10.0.5.11
X-SA-Exim-Mail-From: [email protected]
X-SA-Exim-Version: 4.2.1 (built Fri, 02 Feb 2007 19:02:33 -0700)
X-SA-Exim-Scanned: Yes (on hades.annvix.org)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:174
http://www.mandriva.com/security/
_______________________________________________________________________
Package : krb5
Date : September 6, 2007
Affected: 2007.0, 2007.1, Corporate 4.0
_______________________________________________________________________
Problem Description:
A stack buffer overflow vulnerability was discovered in the RPC
library used by Kerberos' kadmind program by Tenable Network Security.
A remote unauthenticated user who could access kadmind would be
able to trigger the flaw and cause it to crash (CVE-2007-3999).
This issue is only applicable to Kerberos 1.4 and higher.
Garrett Wollman found an uninitialized pointer vulnerability in
kadmind which a remote unauthenticated attacker able to access
kadmind could exploit to cause kadmind to crash (CVE-2007-4000).
This issue is only applicable to Kerberos 1.5 and higher.
Updated packages have been patched to prevent these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4000
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
fee98286370dd34c8f046490d6555179 2007.0/i586/ftp-client-krb5-1.4.3-7.2mdv2007.0.i586.rpm
50456e1353b3e8264212aabf8bb2cf25 2007.0/i586/ftp-server-krb5-1.4.3-7.2mdv2007.0.i586.rpm
d7a788cedbf5e43211c3ccae8e2b43ec 2007.0/i586/krb5-server-1.4.3-7.2mdv2007.0.i586.rpm
da25460534678debf299f891d3124c6d 2007.0/i586/krb5-workstation-1.4.3-7.2mdv2007.0.i586.rpm
6c5574daaf8bd22b219d2146a2305f96 2007.0/i586/libkrb53-1.4.3-7.2mdv2007.0.i586.rpm
342de2dacfdb04349bc6f67303e9a284 2007.0/i586/libkrb53-devel-1.4.3-7.2mdv2007.0.i586.rpm
da4e9f106fc6a84ab6715df1a0682811 2007.0/i586/telnet-client-krb5-1.4.3-7.2mdv2007.0.i586.rpm
bd6d217f5d1b7f2fbbef88500b397778 2007.0/i586/telnet-server-krb5-1.4.3-7.2mdv2007.0.i586.rpm
d2df6f0bb9bba3b73e08f7b1ee864663 2007.0/SRPMS/krb5-1.4.3-7.2mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
31a2e9d08030fdccf17966aaca4c2bc0 2007.0/x86_64/ftp-client-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
e57f555390d1f003cbdc0d1cb72e7c4f 2007.0/x86_64/ftp-server-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
217e0f42dd10aebb632f033759c47ebc 2007.0/x86_64/krb5-server-1.4.3-7.2mdv2007.0.x86_64.rpm
2980773dbc6b1f6683b95aba97c35cd5 2007.0/x86_64/krb5-workstation-1.4.3-7.2mdv2007.0.x86_64.rpm
f5088e63f308401668d57c55f0b77ff0 2007.0/x86_64/lib64krb53-1.4.3-7.2mdv2007.0.x86_64.rpm
8ab20c05069706f52d38e66ebb9eff0d 2007.0/x86_64/lib64krb53-devel-1.4.3-7.2mdv2007.0.x86_64.rpm
320f85004ccd12c7f2d5a60390f82f92 2007.0/x86_64/telnet-client-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
0034ab03a2b730b1579d7b6c7441943d 2007.0/x86_64/telnet-server-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
d2df6f0bb9bba3b73e08f7b1ee864663 2007.0/SRPMS/krb5-1.4.3-7.2mdv2007.0.src.rpm
Mandriva Linux 2007.1:
b1393ec2d736fe5cfc3839c10cfcd4c9 2007.1/i586/ftp-client-krb5-1.5.2-6.4mdv2007.1.i586.rpm
376e94532ed6ff26af47ea67907b508a 2007.1/i586/ftp-server-krb5-1.5.2-6.4mdv2007.1.i586.rpm
86ece0868f36205ae22e82fb9a224c6f 2007.1/i586/krb5-server-1.5.2-6.4mdv2007.1.i586.rpm
b92b05b3fcb8596128f22628a8c0978f 2007.1/i586/krb5-workstation-1.5.2-6.4mdv2007.1.i586.rpm
2ac3a21378e1cba303bf45cbdae4a702 2007.1/i586/libkrb53-1.5.2-6.4mdv2007.1.i586.rpm
c5d5fca0cac517bdf4b2aee7bb4cd093 2007.1/i586/libkrb53-devel-1.5.2-6.4mdv2007.1.i586.rpm
e41bec65196a1f8c8d29d57202722c1e 2007.1/i586/telnet-client-krb5-1.5.2-6.4mdv2007.1.i586.rpm
644d21f340462d6ed9ef06ef51f80a9b 2007.1/i586/telnet-server-krb5-1.5.2-6.4mdv2007.1.i586.rpm
5969e680e558cdbfb5bd58d2055e6690 2007.1/SRPMS/krb5-1.5.2-6.4mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
c868cf665ae10b05a31fd6475c58ae24 2007.1/x86_64/ftp-client-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
a11d2830886a2965e611685b7adeac60 2007.1/x86_64/ftp-server-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
cb4cab90ad5cafdf6ad4bfc2ffcf9728 2007.1/x86_64/krb5-server-1.5.2-6.4mdv2007.1.x86_64.rpm
6569749360719e87fc5ba20a29d4fed6 2007.1/x86_64/krb5-workstation-1.5.2-6.4mdv2007.1.x86_64.rpm
09dfc1222a6ea1bbed684cf91d285792 2007.1/x86_64/lib64krb53-1.5.2-6.4mdv2007.1.x86_64.rpm
1e923fae2747da542674664f6675728b 2007.1/x86_64/lib64krb53-devel-1.5.2-6.4mdv2007.1.x86_64.rpm
060abbb082e448be1906a76b69dd1434 2007.1/x86_64/telnet-client-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
0b6c65e34e4bd42328206a6cebf15b34 2007.1/x86_64/telnet-server-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
5969e680e558cdbfb5bd58d2055e6690 2007.1/SRPMS/krb5-1.5.2-6.4mdv2007.1.src.rpm
Corporate 4.0:
b53ae6dc0c6e135d21f3e2402c3604b4 corporate/4.0/i586/ftp-client-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
2974c7afde71976f7f32ecdf6356d919 corporate/4.0/i586/ftp-server-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
90822e6a2279b6e9965d4da422683fb8 corporate/4.0/i586/krb5-server-1.4.3-5.4.20060mlcs4.i586.rpm
e922c9cf5476b1a703e9f871ea49de9e corporate/4.0/i586/krb5-workstation-1.4.3-5.4.20060mlcs4.i586.rpm
407cb4131f21787e24e2cfd72f022bbd corporate/4.0/i586/libkrb53-1.4.3-5.4.20060mlcs4.i586.rpm
3904b3610e52c7f1dc8dc94fdd01d1cd corporate/4.0/i586/libkrb53-devel-1.4.3-5.4.20060mlcs4.i586.rpm
5159251a5bd64eb90ffcadff2d0d4f54 corporate/4.0/i586/telnet-client-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
4b6e9fa7c7fa2510313fc7daa7c807ef corporate/4.0/i586/telnet-server-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
386f1a12a9e0b1ec1b3d3bebbad29364 corporate/4.0/SRPMS/krb5-1.4.3-5.4.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
c0607489bfa9a184a351e594931d0503 corporate/4.0/x86_64/ftp-client-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
8a4f1b09bd10f8ca3e66a8a1757f5584 corporate/4.0/x86_64/ftp-server-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
f7f0e7e946a789cfaaf8ac6cf300cd13 corporate/4.0/x86_64/krb5-server-1.4.3-5.4.20060mlcs4.x86_64.rpm
19570fc019ca743b748827db346e5e78 corporate/4.0/x86_64/krb5-workstation-1.4.3-5.4.20060mlcs4.x86_64.rpm
b7f69a12ec4e3c8b2e21ecd9a38188d5 corporate/4.0/x86_64/lib64krb53-1.4.3-5.4.20060mlcs4.x86_64.rpm
07945ad05c2de8bbb291892dca8fbdbb corporate/4.0/x86_64/lib64krb53-devel-1.4.3-5.4.20060mlcs4.x86_64.rpm
8f456c326e0ac2db0290e56a879fd36f corporate/4.0/x86_64/telnet-client-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
6b03225e622b79b79dac29329f44be8f corporate/4.0/x86_64/telnet-server-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
386f1a12a9e0b1ec1b3d3bebbad29364 corporate/4.0/SRPMS/krb5-1.4.3-5.4.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFG4DIumqjQ0CJFipgRAoMCAKCP7mybpa/WuUVOJmWXIF11rRv17QCgqDxw
dwEa1dMKhoKDNcjYyoHiGrU=
=2rLi
-----END PGP SIGNATURE-----
