bugtraq - [ MDVSA-2011:117 ] krb5-appl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <E1QkGxM-00062n-F9@titan.mandriva.com>
Date: Fri, 22 Jul 2011 16:44:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2011:117 ] krb5-appl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:117
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : krb5-appl
 Date    : July 22, 2011
 Affected: 2010.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability was discovered and corrected in krb5-appl:
 
 ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications
 (aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid
 return value, which allows remote authenticated users to bypass
 intended group access restrictions, and create, overwrite, delete,
 or read files, via standard FTP commands, related to missing autoconf
 tests in a configure script (CVE-2011-1526).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1526
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2010.1:
 90a608dbdda5554f01ac2d136858550b  2010.1/i586/krb5-appl-clients-1.0-4.1mdv2010.2.i586.rpm
 aeea1b673b042a3c7f534fc455985487  2010.1/i586/krb5-appl-servers-1.0-4.1mdv2010.2.i586.rpm 
 042d96c34567bb41c7b0eedfa2108955  2010.1/SRPMS/krb5-appl-1.0-4.1mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 18e51ba0b42949c6b8663fe854dccfef  2010.1/x86_64/krb5-appl-clients-1.0-4.1mdv2010.2.x86_64.rpm
 041173a8ed33ad691481c89fcd71e76e  2010.1/x86_64/krb5-appl-servers-1.0-4.1mdv2010.2.x86_64.rpm 
 042d96c34567bb41c7b0eedfa2108955  2010.1/SRPMS/krb5-appl-1.0-4.1mdv2010.2.src.rpm

 Mandriva Enterprise Server 5:
 ed220f370dd54abd37f827b0d093b202  mes5/i586/krb5-appl-clients-1.0-0.3mdvmes5.2.i586.rpm
 f0cc53b9afb94ac7a8862fc7eb44ac9f  mes5/i586/krb5-appl-servers-1.0-0.3mdvmes5.2.i586.rpm 
 cfb068705089f1969b4d79ae7ca72da2  mes5/SRPMS/krb5-appl-1.0-0.3mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 d89328c56f8ad81f6348fc6be437c219  mes5/x86_64/krb5-appl-clients-1.0-0.3mdvmes5.2.x86_64.rpm
 3b5b97cd34da9d62574251ba540d64e5  mes5/x86_64/krb5-appl-servers-1.0-0.3mdvmes5.2.x86_64.rpm 
 cfb068705089f1969b4d79ae7ca72da2  mes5/SRPMS/krb5-appl-1.0-0.3mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFOKV+3mqjQ0CJFipgRAnlXAJ9eguRpCYAA8pfoHoKumaaQLkQc4gCeObm2
2dnFqCF165qJlMgsPZZDBNw=
=wWU+
-----END PGP SIGNATURE-----