[USN-719-1] pam-krb5 vulnerabilities
Subject: [USN-719-1] pam-krb5 vulnerabilities
From: Marc Deslauriers <marc.deslauriers@canonical.com.>
To: [email protected]
Cc: "[email protected]" <bugtraq@securityfocus.com.>,
[email protected]
X-Original-To: [email protected]
X-Mailcontrol-Inbound:
uq3drnD2P+ps5SfEb0fvr78+NoP1DHBZwGqKpaXB2eTgNv8D6KLIxb8+NoP1DHBZ8VSaBg0k0xw=
X-Spam-Score: -4.2
X-Scanned-By: MailControl A_08_51_00 (www.mailcontrol.com) on 10.74.0.163
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-K+2S78fml+EGQJhOb1TI"
Date: Thu, 12 Feb 2009 14:18:14 -0500
Message-Id: <1234466294.5854.1.camel@mdlinux.technorage.com.>
Mime-Version: 1.0
X-Mailer: Evolution 2.25.90
X-Virus-Scanned: antivirus-gw at tyumen.ru
--=-K+2S78fml+EGQJhOb1TI
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ubuntu Security Notice USN-719-1 February 12, 2009
libpam-krb5 vulnerabilities
CVE-2009-0360, CVE-2009-0361
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
Ubuntu 8.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
libpam-krb5 3.10-1ubuntu0.8.04.1
Ubuntu 8.10:
libpam-krb5 3.10-1ubuntu0.8.10.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that pam_krb5 parsed environment variables when run with
setuid applications. A local attacker could exploit this flaw to bypass
authentication checks and gain root privileges. (CVE-2009-0360)
Derek Chan discovered that pam_krb5 incorrectly handled refreshing existing
credentials when used with setuid applications. A local attacker could expl=
oit
this to create or overwrite arbitrary files, and possibly gain root privile=
ges.
(CVE-2009-0361)
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.04.1.diff.gz
Size/MD5: 12322 2915d0d5b4133bcc65b6bc03346033b0
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.04.1.dsc
Size/MD5: 816 cbc0e2b13d48682ec29127649d9d3407
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10.orig.tar.gz
Size/MD5: 156259 6ec6bd6637f8c91bf5386ed95fa975ba
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.04.1_amd64.deb
Size/MD5: 78068 6f201eda9f6df9d527c165c21756084d
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.04.1_i386.deb
Size/MD5: 77412 199ba52d9440d89f70fab1544fa90d7f
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ub=
untu0.8.04.1_lpia.deb
Size/MD5: 77246 ff9cce0bbaf03a1a348fcd1fb0ca6745
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ub=
untu0.8.04.1_powerpc.deb
Size/MD5: 80536 e3ec20dbf0fb9666549f801c012f72b0
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ub=
untu0.8.04.1_sparc.deb
Size/MD5: 77196 6e8a12a640e6c9163d65709d68c14775
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.10.1.diff.gz
Size/MD5: 12322 9646c596627edf91af8799f78b9bffb2
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.10.1.dsc
Size/MD5: 1234 39b9545e294f6937092fbf8316ffc9d1
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10.orig.tar.gz
Size/MD5: 156259 6ec6bd6637f8c91bf5386ed95fa975ba
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.10.1_amd64.deb
Size/MD5: 78348 9be5305e9bb4f8b85d0857230cc2acda
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb=
5_3.10-1ubuntu0.8.10.1_i386.deb
Size/MD5: 77494 2e37aba551e192fffaf17754b96fee1a
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ub=
untu0.8.10.1_lpia.deb
Size/MD5: 77452 d89fdc271a18c000d84a2ce6c1c1db4a
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ub=
untu0.8.10.1_powerpc.deb
Size/MD5: 80632 5312557a64d26867ac5472ee56f3ac2e
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ub=
untu0.8.10.1_sparc.deb
Size/MD5: 76978 9fc7e9ee619bd7ce77fafe13a2dc46b8
--=-K+2S78fml+EGQJhOb1TI
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEABECAAYFAkmUdfMACgkQLMAs/0C4zNp82QCfTJbdmxdSxB/OQsHOauhsDwC9
8iAAn17ECwiWrsw9YNzkiV2QZv9CFn0+
=dttc
-----END PGP SIGNATURE-----
--=-K+2S78fml+EGQJhOb1TI--
