bugtraq - [USN-940-2] Kerberos vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20100721083642.GJ3948@outflux.net>
Date: Wed, 21 Jul 2010 01:36:43 -0700
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [USN-940-2] Kerberos vulnerability

===========================================================
Ubuntu Security Notice USN-940-2              July 21, 2010
krb5 vulnerability
CVE-2010-1321
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 10.04 LTS:
  krb5-admin-server               1.8.1+dfsg-2ubuntu0.2

In general, a standard system update will make all the necessary changes.

Details follow:

USN-940-1 fixed vulnerabilities in Kerberos. This update provides the
corresponding updates for Ubuntu 10.04.

Original advisory details:

 Joel Johnson, Brian Almeida, and Shawn Emery discovered that Kerberos
 did not correctly verify certain packet structures. An unauthenticated
 remote attacker could send specially crafted traffic to cause the KDC or
 kadmind services to crash, leading to a denial of service. (CVE-2010-1320,
 CVE-2010-1321)


Updated packages for Ubuntu 10.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5_1.8.1+dfsg-2ubuntu0.2.diff.gz
      Size/MD5:   123331 78e569c0ee8d8896094f6389f3bacc6f
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5_1.8.1+dfsg-2ubuntu0.2.dsc
      Size/MD5:     1721 de1e305c4bfa95b3d2ee5e8b2c6acc59
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5_1.8.1+dfsg.orig.tar.gz
      Size/MD5: 11649920 6f65349b14dcaf862805ff98bfcbd4f8

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5-doc_1.8.1+dfsg-2ubuntu0.2_all.deb
      Size/MD5:  2249008 cc2a81bf8d1e22769ad3da7308217bd9

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5-multidev_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   102446 87333d1f44a396bafadc3bcd4bdc4e56
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5-user_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   136900 f7223c0e21adfc679f9e3efafb4c20d6
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libgssapi-krb5-2_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   128384 7a19cb0301cf235b88cb2bfebbee73f8
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libgssrpc4_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:    81592 503df5ded4e87dfbb24795c233f272b7
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libk5crypto3_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   103842 5c8690b2dbdb3d819ffc57dfc134aab9
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkadm5clnt-mit7_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:    62256 c84a8d5676a0658a6bdabb941d848bcb
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkadm5srv-mit7_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:    76226 4c4a47bf9921a7df7e2c893411b2481e
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkdb5-4_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:    61712 7c7641521d985bf5382d0fb191d1beb8
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5-3_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   368738 f1ade9f90e4c18e896db8153275c9928
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5-dbg_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:  1625554 6d512a37a4adb5cc23211688edc30593
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5-dev_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:    35854 3ad86546037029a028618020b0f9660b
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5support0_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:    44144 b6b3f9e68b74689b6dc479f0bd9b2b95
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-admin-server_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   112652 4f78886d637506565208c7a63f45d3ba
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-kdc-ldap_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   116408 b9f40d5e39abccfeab9234878a579f38
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-kdc_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:   218044 646a63567579b65fd1e52cca8c3c28c2
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-pkinit_1.8.1+dfsg-2ubuntu0.2_amd64.deb
      Size/MD5:    76594 3e6ae0bb09e5d181495f70438f5187e2

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5-multidev_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:   102442 31aa339834bc1f9b5e2e1083db6f8ff3
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/krb5-user_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:   127630 53e09078c606cb08f67dfeacd8c9d5a6
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libgssapi-krb5-2_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:   120402 cc68c812cad5e61420f9e503b5534e73
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libgssrpc4_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    75058 78be7b6b7705b3a7bd7eb7971d90546f
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libk5crypto3_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    96260 3c465fd5205bead5600104c282587931
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkadm5clnt-mit7_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    58798 82e55cb4bc08138003d7a4715bfdc52d
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkadm5srv-mit7_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    71768 361392d2933fd6386004cb753ce7d25a
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkdb5-4_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    58910 e42f46ff5eb81d7aea93d5c6db79e094
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5-3_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:   350118 0a939e0246c5ca64bfa81aab6da0a9f8
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5-dbg_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:  1607430 1937b240e91cfc5c272f0096977d0ffa
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5-dev_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    35864 6aeecfee803b27c9a77bf93155a5598a
    http://security.ubuntu.com/ubuntu/pool/main/k/krb5/libkrb5support0_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    42350 33eb604c6182c4b278741d5255ad5ef3
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-admin-server_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:   104910 379d9f1fa8f456343238bab17a9d8eca
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-kdc-ldap_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:   110630 60b175d3ba3ed385c7aed20b49dd35fd
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-kdc_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:   201548 2154494519fb72693b251e4427ed2dd6
    http://security.ubuntu.com/ubuntu/pool/universe/k/krb5/krb5-pkinit_1.8.1+dfsg-2ubuntu0.2_i386.deb
      Size/MD5:    73498 dde108abe35c08bf6a30372abd9e2bc5

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/k/krb5/krb5-multidev_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   102446 b397bace2b3f0f7283e4e0550a9247e5
    http://ports.ubuntu.com/pool/main/k/krb5/krb5-user_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   134014 f30e550b26277f322e877139e50e50cf
    http://ports.ubuntu.com/pool/main/k/krb5/libgssapi-krb5-2_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   126456 49cdd7578922f1a45563b883d6cd408d
    http://ports.ubuntu.com/pool/main/k/krb5/libgssrpc4_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:    80498 f4d38760dcad8d8df6249e56918ecd90
    http://ports.ubuntu.com/pool/main/k/krb5/libk5crypto3_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   110708 1f7c80f6ba2b260b2887c0fefa070c82
    http://ports.ubuntu.com/pool/main/k/krb5/libkadm5clnt-mit7_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:    60722 7a66dd223ab415c181450c4b61f6d52f
    http://ports.ubuntu.com/pool/main/k/krb5/libkadm5srv-mit7_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:    75420 1bbbacf0d770a91608bc21bfa1d332a6
    http://ports.ubuntu.com/pool/main/k/krb5/libkdb5-4_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:    61064 2af654b7e71caf9878c3d8e7160ac7f7
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5-3_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   372640 8fff5043bd3fc134b736700f46f30c34
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5-dbg_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:  1674080 04bae9840676a74095f11377d153519d
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5-dev_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:    35866 5f731e178b6e022db7d17b67dad6e452
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5support0_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:    43652 c3030b1a25216c882da420746c2401ff
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-admin-server_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   110618 5a31215feb7db46b9395cc2b098e5a30
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-kdc-ldap_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   116234 c959bf6d8e654d8a9973dd0af716d677
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-kdc_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:   214924 619c109260923a8f2567fa6f4a064cc5
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-pkinit_1.8.1+dfsg-2ubuntu0.2_powerpc.deb
      Size/MD5:    74604 6b23193ebc45f3da4c7cb9c5a0edcca7

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/k/krb5/krb5-multidev_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   102456 175d905446b74728e659f509c9a2b895
    http://ports.ubuntu.com/pool/main/k/krb5/krb5-user_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   131794 91698366e846f5894e438209d83f528b
    http://ports.ubuntu.com/pool/main/k/krb5/libgssapi-krb5-2_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   114736 9f091d1b0e8e3fde1f080de713572971
    http://ports.ubuntu.com/pool/main/k/krb5/libgssrpc4_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:    75900 80530df6265759dfb80939917f51ac50
    http://ports.ubuntu.com/pool/main/k/krb5/libk5crypto3_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   109114 47ae8817034f27e7979864aea78cf0bd
    http://ports.ubuntu.com/pool/main/k/krb5/libkadm5clnt-mit7_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:    57954 8ed99602edc9767a29a0e0f074cd1c88
    http://ports.ubuntu.com/pool/main/k/krb5/libkadm5srv-mit7_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:    70128 e5e4f88171e5534cd5d4e57f55500652
    http://ports.ubuntu.com/pool/main/k/krb5/libkdb5-4_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:    57686 488574c5c040d7b262703009b0d78a69
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5-3_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   341926 2c01cde93e84840a3cd42245d73c15d8
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5-dbg_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:  1519622 7adfba6fe20d5faf8753dc7a43ead96f
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5-dev_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:    35866 b1f6d0a523785a4a08d67fbb1f16b884
    http://ports.ubuntu.com/pool/main/k/krb5/libkrb5support0_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:    42388 f53664c8f82eac8284a6e935594978d2
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-admin-server_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   108036 e784fb3030af02cea244ee96b8bc6a67
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-kdc-ldap_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   111498 0b90f12f1f836df31d12c55646cd9620
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-kdc_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:   205714 a4fd1a7a8ede1c01b284ee6fae745cb6
    http://ports.ubuntu.com/pool/universe/k/krb5/krb5-pkinit_1.8.1+dfsg-2ubuntu0.2_sparc.deb
      Size/MD5:    69382 5c4fb52b4ccf5eff620312bb3960fe79


Download attachment "signature.asc" of type "application/pgp-signature" (237 bytes)