bugtraq - [ MDVSA-2011:160 ] krb5

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1RHjJM-0003lX-SL@titan.mandriva.com>
Date: Sat, 22 Oct 2011 23:41:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2011:160 ] krb5

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:160
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : krb5
 Date    : October 22, 2011
 Affected: 2010.1, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been found and corrected in krb5:
 
 The krb5_ldap_lockout_audit function in the Key Distribution Center
 (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through
 1.9.1, when the LDAP back end is used, allows remote attackers to cause
 a denial of service (assertion failure and daemon exit) via unspecified
 vectors, related to the locked_check_p function (CVE-2011-1528).
 
 The lookup_lockout_policy function in the Key Distribution Center (KDC)
 in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1,
 when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote
 attackers to cause a denial of service (NULL pointer dereference and
 daemon crash) via vectors that trigger certain process_as_req errors
 (CVE-2011-1529).
 
 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1528
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1529
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2010.1:
 3c2e6b5720aafe4283403170c2d58492  2010.1/i586/krb5-1.8.1-5.6mdv2010.2.i586.rpm
 3ac1a5668862182f3a48338c2f76cf81  2010.1/i586/krb5-pkinit-openssl-1.8.1-5.6mdv2010.2.i586.rpm
 0fc35189df3032ea14d295cf8bc58839  2010.1/i586/krb5-server-1.8.1-5.6mdv2010.2.i586.rpm
 00caac26b6e5a59d776440266002b3ab  2010.1/i586/krb5-server-ldap-1.8.1-5.6mdv2010.2.i586.rpm
 a5320af15d594506ad2055b739211565  2010.1/i586/krb5-workstation-1.8.1-5.6mdv2010.2.i586.rpm
 0bba786af6f0e73b380bfa77321aaee5  2010.1/i586/libkrb53-1.8.1-5.6mdv2010.2.i586.rpm
 c233f28e23d554bf8cbc62c22f7e4a44  2010.1/i586/libkrb53-devel-1.8.1-5.6mdv2010.2.i586.rpm 
 0f748bb4522391005759bf2915b67d89  2010.1/SRPMS/krb5-1.8.1-5.6mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 a24d3b618ae99dc2d2197c5df1adcbfc  2010.1/x86_64/krb5-1.8.1-5.6mdv2010.2.x86_64.rpm
 78ffd9611e8106a61fb00201504110a7  2010.1/x86_64/krb5-pkinit-openssl-1.8.1-5.6mdv2010.2.x86_64.rpm
 3b9baf5a46fc90e9cf0069c23bd87655  2010.1/x86_64/krb5-server-1.8.1-5.6mdv2010.2.x86_64.rpm
 f7e6d0006e504520bf811144c2639238  2010.1/x86_64/krb5-server-ldap-1.8.1-5.6mdv2010.2.x86_64.rpm
 cbcdb6e8882eb7f0b2d2933e7620c108  2010.1/x86_64/krb5-workstation-1.8.1-5.6mdv2010.2.x86_64.rpm
 06549d9617286d573fac8c522f62edfb  2010.1/x86_64/lib64krb53-1.8.1-5.6mdv2010.2.x86_64.rpm
 ba81b94a26532fb2bddc3d5de201aa76  2010.1/x86_64/lib64krb53-devel-1.8.1-5.6mdv2010.2.x86_64.rpm 
 0f748bb4522391005759bf2915b67d89  2010.1/SRPMS/krb5-1.8.1-5.6mdv2010.2.src.rpm

 Mandriva Enterprise Server 5:
 1aace07998863fe7f30d2fb91993d7b2  mes5/i586/krb5-1.8.1-0.7mdvmes5.2.i586.rpm
 d4b71902ff32d362e2a5d7fe2e4e9a71  mes5/i586/krb5-pkinit-openssl-1.8.1-0.7mdvmes5.2.i586.rpm
 858c3babd9f4fa4badd04a3676c755c7  mes5/i586/krb5-server-1.8.1-0.7mdvmes5.2.i586.rpm
 63a002132291b4cda6a750e47ec0bece  mes5/i586/krb5-server-ldap-1.8.1-0.7mdvmes5.2.i586.rpm
 7238700c172cf9e4c7b94af1f016201c  mes5/i586/krb5-workstation-1.8.1-0.7mdvmes5.2.i586.rpm
 3e3b2122ea7a58503d26713254e9f97b  mes5/i586/libkrb53-1.8.1-0.7mdvmes5.2.i586.rpm
 ae343104b7643e7558930d2f85af5091  mes5/i586/libkrb53-devel-1.8.1-0.7mdvmes5.2.i586.rpm 
 1b3d691cf8b9d2c01463593cf4e2e1d5  mes5/SRPMS/krb5-1.8.1-0.7mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 b1912a66538b9c45c67691d2a3523576  mes5/x86_64/krb5-1.8.1-0.7mdvmes5.2.x86_64.rpm
 2f1989fb1412fc1581f41d416146e659  mes5/x86_64/krb5-pkinit-openssl-1.8.1-0.7mdvmes5.2.x86_64.rpm
 6f34d14eae154ff5991e248c18021eb2  mes5/x86_64/krb5-server-1.8.1-0.7mdvmes5.2.x86_64.rpm
 69649b642ac23f458d8e02f1e7d549d0  mes5/x86_64/krb5-server-ldap-1.8.1-0.7mdvmes5.2.x86_64.rpm
 50f5feb5c21c5a246917e0b06faf28c6  mes5/x86_64/krb5-workstation-1.8.1-0.7mdvmes5.2.x86_64.rpm
 4a2e291f75ec2288df3a7c28ea5b2ba1  mes5/x86_64/lib64krb53-1.8.1-0.7mdvmes5.2.x86_64.rpm
 f95b08bf29f82897105d8b853b42df67  mes5/x86_64/lib64krb53-devel-1.8.1-0.7mdvmes5.2.x86_64.rpm 
 1b3d691cf8b9d2c01463593cf4e2e1d5  mes5/SRPMS/krb5-1.8.1-0.7mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iD8DBQFOowuemqjQ0CJFipgRAtdAAKDf18b6efSa7KUB3TUBaDfiHJihJwCdEFMt
QZ51mW/TSrFXZLFvxVlvrmI=
=z3o3
-----END PGP SIGNATURE-----