• News
• Infocus
• Foundations
• Microsoft
• Unix
• IDS
• Incidents
• Virus
• Pen-Test
• Firewalls
• Columnists
• Mailing Lists
• Newsletters
• Bugtraq
• Focus on IDS
• Focus on Linux
• Focus on Microsoft
• Forensics
• Pen-test
• Security Basics
• Vuln Dev
• Vulnerabilities
• Jobs
• Job Opportunities
• Resumes
• Job Seekers
• Employers
• Tools
• RSS
• News
• Vulns
• Security Research

• info
• discussion
• exploit
• solution
• references

Multiple Vendor Kerberos 4 Temporary File Race Condition Vulnerability

Solution:
Upgrade to KTH Kerberos 4 version 1.0.4. NetBSD has released a patch for NetBSD 1.5.

MIT has released krb5-1.2.2 which incorporates a fix for this. A patch for the krb4 library is also available if upgrading to this version is not feasible.


KTH Kerberos 4 1.0

• FreeBSD 3.5.1 telnetd-krb.3.5.1.patch
  ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:25/telnetd-krb.3. 5.1.patch


• FreeBSD 4.2 telnetd-krb.4.2.patch
  ftp://ftp.freebsd.org/pub/FreeBSD/CERT/patches/SA-01:25/telnetd-krb.4. 2.patch

KTH Kerberos 4 1.0.3

• KTH Kerberos 4 1.0.4
  ftp://ftp.pdc.kth.se/pub/krb/src/krb4-1.0.4.tar.gz


• NetBSD 20001220-krb
  ftp://ftp.NetBSD.ORG/pub/NetBSD/misc/security/patches/20001220-krb

MIT Kerberos 5 1.2.1

• MIT krb4tkt_121_patch
  Recompile or relink your login daemons after applying this patch.
  http://web.mit.edu/kerberos/www/advisories/krb4tkt_121_patch.txt