BugTraq
[ MDVSA-2011:160 ] krb5 Oct 22 2011 09:41PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:160
http://www.mandriva.com/security/
_______________________________________________________________________

Package : krb5
Date : October 22, 2011
Affected: 2010.1, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been found and corrected in krb5:

The krb5_ldap_lockout_audit function in the Key Distribution Center
(KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through
1.9.1, when the LDAP back end is used, allows remote attackers to cause
a denial of service (assertion failure and daemon exit) via unspecified
vectors, related to the locked_check_p function (CVE-2011-1528).

The lookup_lockout_policy function in the Key Distribution Center (KDC)
in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1,
when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote
attackers to cause a denial of service (NULL pointer dereference and
daemon crash) via vectors that trigger certain process_as_req errors
(CVE-2011-1529).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1528
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1529
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.1:
3c2e6b5720aafe4283403170c2d58492 2010.1/i586/krb5-1.8.1-5.6mdv2010.2.i586.rpm
3ac1a5668862182f3a48338c2f76cf81 2010.1/i586/krb5-pkinit-openssl-1.8.1-5.6mdv2010.2.i586.rpm
0fc35189df3032ea14d295cf8bc58839 2010.1/i586/krb5-server-1.8.1-5.6mdv2010.2.i586.rpm
00caac26b6e5a59d776440266002b3ab 2010.1/i586/krb5-server-ldap-1.8.1-5.6mdv2010.2.i586.rpm
a5320af15d594506ad2055b739211565 2010.1/i586/krb5-workstation-1.8.1-5.6mdv2010.2.i586.rpm
0bba786af6f0e73b380bfa77321aaee5 2010.1/i586/libkrb53-1.8.1-5.6mdv2010.2.i586.rpm
c233f28e23d554bf8cbc62c22f7e4a44 2010.1/i586/libkrb53-devel-1.8.1-5.6mdv2010.2.i586.rpm
0f748bb4522391005759bf2915b67d89 2010.1/SRPMS/krb5-1.8.1-5.6mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
a24d3b618ae99dc2d2197c5df1adcbfc 2010.1/x86_64/krb5-1.8.1-5.6mdv2010.2.x86_64.rpm
78ffd9611e8106a61fb00201504110a7 2010.1/x86_64/krb5-pkinit-openssl-1.8.1-5.6mdv2010.2.x86_64.rpm
3b9baf5a46fc90e9cf0069c23bd87655 2010.1/x86_64/krb5-server-1.8.1-5.6mdv2010.2.x86_64.rpm
f7e6d0006e504520bf811144c2639238 2010.1/x86_64/krb5-server-ldap-1.8.1-5.6mdv2010.2.x86_64.rpm
cbcdb6e8882eb7f0b2d2933e7620c108 2010.1/x86_64/krb5-workstation-1.8.1-5.6mdv2010.2.x86_64.rpm
06549d9617286d573fac8c522f62edfb 2010.1/x86_64/lib64krb53-1.8.1-5.6mdv2010.2.x86_64.rpm
ba81b94a26532fb2bddc3d5de201aa76 2010.1/x86_64/lib64krb53-devel-1.8.1-5.6mdv2010.2.x86_64.rpm
0f748bb4522391005759bf2915b67d89 2010.1/SRPMS/krb5-1.8.1-5.6mdv2010.2.src.rpm

Mandriva Enterprise Server 5:
1aace07998863fe7f30d2fb91993d7b2 mes5/i586/krb5-1.8.1-0.7mdvmes5.2.i586.rpm
d4b71902ff32d362e2a5d7fe2e4e9a71 mes5/i586/krb5-pkinit-openssl-1.8.1-0.7mdvmes5.2.i586.rpm
858c3babd9f4fa4badd04a3676c755c7 mes5/i586/krb5-server-1.8.1-0.7mdvmes5.2.i586.rpm
63a002132291b4cda6a750e47ec0bece mes5/i586/krb5-server-ldap-1.8.1-0.7mdvmes5.2.i586.rpm
7238700c172cf9e4c7b94af1f016201c mes5/i586/krb5-workstation-1.8.1-0.7mdvmes5.2.i586.rpm
3e3b2122ea7a58503d26713254e9f97b mes5/i586/libkrb53-1.8.1-0.7mdvmes5.2.i586.rpm
ae343104b7643e7558930d2f85af5091 mes5/i586/libkrb53-devel-1.8.1-0.7mdvmes5.2.i586.rpm
1b3d691cf8b9d2c01463593cf4e2e1d5 mes5/SRPMS/krb5-1.8.1-0.7mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
b1912a66538b9c45c67691d2a3523576 mes5/x86_64/krb5-1.8.1-0.7mdvmes5.2.x86_64.rpm
2f1989fb1412fc1581f41d416146e659 mes5/x86_64/krb5-pkinit-openssl-1.8.1-0.7mdvmes5.2.x86_64.rpm
6f34d14eae154ff5991e248c18021eb2 mes5/x86_64/krb5-server-1.8.1-0.7mdvmes5.2.x86_64.rpm
69649b642ac23f458d8e02f1e7d549d0 mes5/x86_64/krb5-server-ldap-1.8.1-0.7mdvmes5.2.x86_64.rpm
50f5feb5c21c5a246917e0b06faf28c6 mes5/x86_64/krb5-workstation-1.8.1-0.7mdvmes5.2.x86_64.rpm
4a2e291f75ec2288df3a7c28ea5b2ba1 mes5/x86_64/lib64krb53-1.8.1-0.7mdvmes5.2.x86_64.rpm
f95b08bf29f82897105d8b853b42df67 mes5/x86_64/lib64krb53-devel-1.8.1-0.7mdvmes5.2.x86_64.rpm
1b3d691cf8b9d2c01463593cf4e2e1d5 mes5/SRPMS/krb5-1.8.1-0.7mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFOowuemqjQ0CJFipgRAtdAAKDf18b6efSa7KUB3TUBaDfiHJihJwCdEFMt
QZ51mW/TSrFXZLFvxVlvrmI=
=z3o3
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus