full-disclosure - [ MDKSA-2007:008 ] - Updated kerberos packages fix vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1H4rBY-000659-HG@artemis.annvix.ca>
Date: Wed, 10 Jan 2007 21:05:04 -0700
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDKSA-2007:008 ] - Updated kerberos packages
	fix vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:008
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : krb5
 Date    : January 10, 2007
 Affected: 2006.0, 2007.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 A vulnerability in the RPC library in Kerberos 1.4.x and 1.5.x as used
 in the kadmind administration daemon calls an uninitialized function
 pointer in freed memory, which could allow a remote attacker to cause a
 Denial of Service and possibly execute arbitrary code via unspecified
 vectors.

 Updated packages are patched to address this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6143
 http://www.cert.org/advisories/481564
 http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-002-rpc.txt
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 a60e03243b204a7b0281d32aff6c7877  2006.0/i586/ftp-client-krb5-1.4.2-1.2.20060mdk.i586.rpm
 98552d247f0bd6231310715dd1fbb4a4  2006.0/i586/ftp-server-krb5-1.4.2-1.2.20060mdk.i586.rpm
 50eff45fd46afd3e04147cbd98fa99cd  2006.0/i586/krb5-server-1.4.2-1.2.20060mdk.i586.rpm
 58b570956596827c6c83db43b3b6ec4d  2006.0/i586/krb5-workstation-1.4.2-1.2.20060mdk.i586.rpm
 63f2980118e016c51bb8707d6f32eec5  2006.0/i586/libkrb53-1.4.2-1.2.20060mdk.i586.rpm
 362a93222614d35ea479318701695b9a  2006.0/i586/libkrb53-devel-1.4.2-1.2.20060mdk.i586.rpm
 19336d7d0cbc13f337b6d883e19c90c0  2006.0/i586/telnet-client-krb5-1.4.2-1.2.20060mdk.i586.rpm
 474a525a042f18b8f20c1353d34f4d94  2006.0/i586/telnet-server-krb5-1.4.2-1.2.20060mdk.i586.rpm 
 4e9722344646e273932c56b85edb747d  2006.0/SRPMS/krb5-1.4.2-1.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 f3c2542c797907b053505c229aabb7bc  2006.0/x86_64/ftp-client-krb5-1.4.2-1.2.20060mdk.x86_64.rpm
 478f693737b4aeb347c143c768d311aa  2006.0/x86_64/ftp-server-krb5-1.4.2-1.2.20060mdk.x86_64.rpm
 be81c7a72bf4c58888f87b8e1de6138e  2006.0/x86_64/krb5-server-1.4.2-1.2.20060mdk.x86_64.rpm
 f257c6013dcc018fd888e99ebd1979e9  2006.0/x86_64/krb5-workstation-1.4.2-1.2.20060mdk.x86_64.rpm
 2caec1d3046bc492c5fff8acea793d6b  2006.0/x86_64/lib64krb53-1.4.2-1.2.20060mdk.x86_64.rpm
 e42da64bf42609db45cfcf870c86e38c  2006.0/x86_64/lib64krb53-devel-1.4.2-1.2.20060mdk.x86_64.rpm
 119e125072bda0a478d0fc6f599c65d1  2006.0/x86_64/telnet-client-krb5-1.4.2-1.2.20060mdk.x86_64.rpm
 8d14872dd37351092def43f732ad91d9  2006.0/x86_64/telnet-server-krb5-1.4.2-1.2.20060mdk.x86_64.rpm 
 4e9722344646e273932c56b85edb747d  2006.0/SRPMS/krb5-1.4.2-1.2.20060mdk.src.rpm

 Mandriva Linux 2007.0:
 a4d1443d510f1fef80ae2716f4c669ac  2007.0/i586/ftp-client-krb5-1.4.3-6.1mdv2007.0.i586.rpm
 6ad2482bea8be0953e8804e17b5f6be6  2007.0/i586/ftp-server-krb5-1.4.3-6.1mdv2007.0.i586.rpm
 0bdec1016065a8bb04089edd69dcaf67  2007.0/i586/krb5-server-1.4.3-6.1mdv2007.0.i586.rpm
 c51cb207bf1d7adcb7e73ca236247e60  2007.0/i586/krb5-workstation-1.4.3-6.1mdv2007.0.i586.rpm
 f49d9636ec2ee3be4160f004c9987407  2007.0/i586/libkrb53-1.4.3-6.1mdv2007.0.i586.rpm
 186959cc727e6542a413e18e6606fb0e  2007.0/i586/libkrb53-devel-1.4.3-6.1mdv2007.0.i586.rpm
 327c7461f838c7a4ca9f23500d0581ff  2007.0/i586/telnet-client-krb5-1.4.3-6.1mdv2007.0.i586.rpm
 36c8eae2a02a09d2b93aa00518e0b879  2007.0/i586/telnet-server-krb5-1.4.3-6.1mdv2007.0.i586.rpm 
 8b18bbe4f22325dd4ee5a99eef7e32dd  2007.0/SRPMS/krb5-1.4.3-6.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 9e8a87605787eb574739756f86f00183  2007.0/x86_64/ftp-client-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm
 0ed4b823492d3d69947610f9b95cd44a  2007.0/x86_64/ftp-server-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm
 4cfa5d7da28f635c4ddb390f16f2dd32  2007.0/x86_64/krb5-server-1.4.3-6.1mdv2007.0.x86_64.rpm
 1546df114a3c250d7c2cf01a10daa6fc  2007.0/x86_64/krb5-workstation-1.4.3-6.1mdv2007.0.x86_64.rpm
 13b45d5e3efbc4d5ef0025ef3eb73cd3  2007.0/x86_64/lib64krb53-1.4.3-6.1mdv2007.0.x86_64.rpm
 5b1a6627c0ce7cfa165f0a594b031a3b  2007.0/x86_64/lib64krb53-devel-1.4.3-6.1mdv2007.0.x86_64.rpm
 18aedb28ddfc99096925047b21a7bd2c  2007.0/x86_64/telnet-client-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm
 cc35d21b8c920f9379b6e0868dec98fd  2007.0/x86_64/telnet-server-krb5-1.4.3-6.1mdv2007.0.x86_64.rpm 
 8b18bbe4f22325dd4ee5a99eef7e32dd  2007.0/SRPMS/krb5-1.4.3-6.1mdv2007.0.src.rpm

 Corporate 4.0:
 ddc1741afd0fabd609587f8006f9a1ea  corporate/4.0/i586/ftp-client-krb5-1.4.3-5.1.20060mlcs4.i586.rpm
 2a5b69d4febcc3c3431a812c04a882d7  corporate/4.0/i586/ftp-server-krb5-1.4.3-5.1.20060mlcs4.i586.rpm
 6d1ed5b8ac4bb3ddc0855501eef24baf  corporate/4.0/i586/krb5-server-1.4.3-5.1.20060mlcs4.i586.rpm
 c5d87ffc5d7c09acb2b9915447fa6f5b  corporate/4.0/i586/krb5-workstation-1.4.3-5.1.20060mlcs4.i586.rpm
 139ba7efec113d4bf8cf052daee30694  corporate/4.0/i586/libkrb53-1.4.3-5.1.20060mlcs4.i586.rpm
 202c1536fbec4a847cee0f84b037c882  corporate/4.0/i586/libkrb53-devel-1.4.3-5.1.20060mlcs4.i586.rpm
 0066928b2dccd73cda873b156d787488  corporate/4.0/i586/telnet-client-krb5-1.4.3-5.1.20060mlcs4.i586.rpm
 bc7d767c2521955910621311a52f8dc5  corporate/4.0/i586/telnet-server-krb5-1.4.3-5.1.20060mlcs4.i586.rpm 
 079d5b68cd5c33a1d3dcd31c37be59b7  corporate/4.0/SRPMS/krb5-1.4.3-5.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 c7b2c83ca051117c72daaa864930dc4f  corporate/4.0/x86_64/ftp-client-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm
 76da52f8afb94def7cf7ce7aaed54737  corporate/4.0/x86_64/ftp-server-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm
 b1728594817b87985cb5ceb8bbd2cc56  corporate/4.0/x86_64/krb5-server-1.4.3-5.1.20060mlcs4.x86_64.rpm
 5bef7e859d36c1d9c84606ad988c30e5  corporate/4.0/x86_64/krb5-workstation-1.4.3-5.1.20060mlcs4.x86_64.rpm
 6a535d673befe0bfb79889b772382f1f  corporate/4.0/x86_64/lib64krb53-1.4.3-5.1.20060mlcs4.x86_64.rpm
 3da23da5792fba1bf65cbd56eb91dead  corporate/4.0/x86_64/lib64krb53-devel-1.4.3-5.1.20060mlcs4.x86_64.rpm
 1eaf0cd620c4c5e3685f6dc2242c191f  corporate/4.0/x86_64/telnet-client-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm
 a0676ac080ced1911ffed68055afac3e  corporate/4.0/x86_64/telnet-server-krb5-1.4.3-5.1.20060mlcs4.x86_64.rpm 
 079d5b68cd5c33a1d3dcd31c37be59b7  corporate/4.0/SRPMS/krb5-1.4.3-5.1.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFpYwMmqjQ0CJFipgRAnt1AKCpDRqKBrTK8N3GjUdTkr+Kkvze1wCeKy5d
GmWwPOZ59ZFvM/BsVBsEAvg=
=nQrK
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/