full-disclosure - [ MDKSA-2007:174 ] - Updated krb5 packages fix vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1ITNa2-0005Jt-Nz@artemis.annvix.ca>
Date: Thu, 06 Sep 2007 14:03:58 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDKSA-2007:174 ] - Updated krb5 packages fix
	vulnerabilities


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:174
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : krb5
 Date    : September 6, 2007
 Affected: 2007.0, 2007.1, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 A stack buffer overflow vulnerability was discovered in the RPC
 library used by Kerberos' kadmind program by Tenable Network Security.
 A remote unauthenticated user who could access kadmind would be
 able to trigger the flaw and cause it to crash (CVE-2007-3999).
 This issue is only applicable to Kerberos 1.4 and higher.
 
 Garrett Wollman found an uninitialized pointer vulnerability in
 kadmind which a remote unauthenticated attacker able to access
 kadmind could exploit to cause kadmind to crash (CVE-2007-4000).
 This issue is only applicable to Kerberos 1.5 and higher.
 
 Updated packages have been patched to prevent these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3999
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4000
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 fee98286370dd34c8f046490d6555179  2007.0/i586/ftp-client-krb5-1.4.3-7.2mdv2007.0.i586.rpm
 50456e1353b3e8264212aabf8bb2cf25  2007.0/i586/ftp-server-krb5-1.4.3-7.2mdv2007.0.i586.rpm
 d7a788cedbf5e43211c3ccae8e2b43ec  2007.0/i586/krb5-server-1.4.3-7.2mdv2007.0.i586.rpm
 da25460534678debf299f891d3124c6d  2007.0/i586/krb5-workstation-1.4.3-7.2mdv2007.0.i586.rpm
 6c5574daaf8bd22b219d2146a2305f96  2007.0/i586/libkrb53-1.4.3-7.2mdv2007.0.i586.rpm
 342de2dacfdb04349bc6f67303e9a284  2007.0/i586/libkrb53-devel-1.4.3-7.2mdv2007.0.i586.rpm
 da4e9f106fc6a84ab6715df1a0682811  2007.0/i586/telnet-client-krb5-1.4.3-7.2mdv2007.0.i586.rpm
 bd6d217f5d1b7f2fbbef88500b397778  2007.0/i586/telnet-server-krb5-1.4.3-7.2mdv2007.0.i586.rpm 
 d2df6f0bb9bba3b73e08f7b1ee864663  2007.0/SRPMS/krb5-1.4.3-7.2mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 31a2e9d08030fdccf17966aaca4c2bc0  2007.0/x86_64/ftp-client-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
 e57f555390d1f003cbdc0d1cb72e7c4f  2007.0/x86_64/ftp-server-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
 217e0f42dd10aebb632f033759c47ebc  2007.0/x86_64/krb5-server-1.4.3-7.2mdv2007.0.x86_64.rpm
 2980773dbc6b1f6683b95aba97c35cd5  2007.0/x86_64/krb5-workstation-1.4.3-7.2mdv2007.0.x86_64.rpm
 f5088e63f308401668d57c55f0b77ff0  2007.0/x86_64/lib64krb53-1.4.3-7.2mdv2007.0.x86_64.rpm
 8ab20c05069706f52d38e66ebb9eff0d  2007.0/x86_64/lib64krb53-devel-1.4.3-7.2mdv2007.0.x86_64.rpm
 320f85004ccd12c7f2d5a60390f82f92  2007.0/x86_64/telnet-client-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
 0034ab03a2b730b1579d7b6c7441943d  2007.0/x86_64/telnet-server-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm 
 d2df6f0bb9bba3b73e08f7b1ee864663  2007.0/SRPMS/krb5-1.4.3-7.2mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 b1393ec2d736fe5cfc3839c10cfcd4c9  2007.1/i586/ftp-client-krb5-1.5.2-6.4mdv2007.1.i586.rpm
 376e94532ed6ff26af47ea67907b508a  2007.1/i586/ftp-server-krb5-1.5.2-6.4mdv2007.1.i586.rpm
 86ece0868f36205ae22e82fb9a224c6f  2007.1/i586/krb5-server-1.5.2-6.4mdv2007.1.i586.rpm
 b92b05b3fcb8596128f22628a8c0978f  2007.1/i586/krb5-workstation-1.5.2-6.4mdv2007.1.i586.rpm
 2ac3a21378e1cba303bf45cbdae4a702  2007.1/i586/libkrb53-1.5.2-6.4mdv2007.1.i586.rpm
 c5d5fca0cac517bdf4b2aee7bb4cd093  2007.1/i586/libkrb53-devel-1.5.2-6.4mdv2007.1.i586.rpm
 e41bec65196a1f8c8d29d57202722c1e  2007.1/i586/telnet-client-krb5-1.5.2-6.4mdv2007.1.i586.rpm
 644d21f340462d6ed9ef06ef51f80a9b  2007.1/i586/telnet-server-krb5-1.5.2-6.4mdv2007.1.i586.rpm 
 5969e680e558cdbfb5bd58d2055e6690  2007.1/SRPMS/krb5-1.5.2-6.4mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 c868cf665ae10b05a31fd6475c58ae24  2007.1/x86_64/ftp-client-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
 a11d2830886a2965e611685b7adeac60  2007.1/x86_64/ftp-server-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
 cb4cab90ad5cafdf6ad4bfc2ffcf9728  2007.1/x86_64/krb5-server-1.5.2-6.4mdv2007.1.x86_64.rpm
 6569749360719e87fc5ba20a29d4fed6  2007.1/x86_64/krb5-workstation-1.5.2-6.4mdv2007.1.x86_64.rpm
 09dfc1222a6ea1bbed684cf91d285792  2007.1/x86_64/lib64krb53-1.5.2-6.4mdv2007.1.x86_64.rpm
 1e923fae2747da542674664f6675728b  2007.1/x86_64/lib64krb53-devel-1.5.2-6.4mdv2007.1.x86_64.rpm
 060abbb082e448be1906a76b69dd1434  2007.1/x86_64/telnet-client-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
 0b6c65e34e4bd42328206a6cebf15b34  2007.1/x86_64/telnet-server-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm 
 5969e680e558cdbfb5bd58d2055e6690  2007.1/SRPMS/krb5-1.5.2-6.4mdv2007.1.src.rpm

 Corporate 4.0:
 b53ae6dc0c6e135d21f3e2402c3604b4  corporate/4.0/i586/ftp-client-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
 2974c7afde71976f7f32ecdf6356d919  corporate/4.0/i586/ftp-server-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
 90822e6a2279b6e9965d4da422683fb8  corporate/4.0/i586/krb5-server-1.4.3-5.4.20060mlcs4.i586.rpm
 e922c9cf5476b1a703e9f871ea49de9e  corporate/4.0/i586/krb5-workstation-1.4.3-5.4.20060mlcs4.i586.rpm
 407cb4131f21787e24e2cfd72f022bbd  corporate/4.0/i586/libkrb53-1.4.3-5.4.20060mlcs4.i586.rpm
 3904b3610e52c7f1dc8dc94fdd01d1cd  corporate/4.0/i586/libkrb53-devel-1.4.3-5.4.20060mlcs4.i586.rpm
 5159251a5bd64eb90ffcadff2d0d4f54  corporate/4.0/i586/telnet-client-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
 4b6e9fa7c7fa2510313fc7daa7c807ef  corporate/4.0/i586/telnet-server-krb5-1.4.3-5.4.20060mlcs4.i586.rpm 
 386f1a12a9e0b1ec1b3d3bebbad29364  corporate/4.0/SRPMS/krb5-1.4.3-5.4.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 c0607489bfa9a184a351e594931d0503  corporate/4.0/x86_64/ftp-client-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
 8a4f1b09bd10f8ca3e66a8a1757f5584  corporate/4.0/x86_64/ftp-server-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
 f7f0e7e946a789cfaaf8ac6cf300cd13  corporate/4.0/x86_64/krb5-server-1.4.3-5.4.20060mlcs4.x86_64.rpm
 19570fc019ca743b748827db346e5e78  corporate/4.0/x86_64/krb5-workstation-1.4.3-5.4.20060mlcs4.x86_64.rpm
 b7f69a12ec4e3c8b2e21ecd9a38188d5  corporate/4.0/x86_64/lib64krb53-1.4.3-5.4.20060mlcs4.x86_64.rpm
 07945ad05c2de8bbb291892dca8fbdbb  corporate/4.0/x86_64/lib64krb53-devel-1.4.3-5.4.20060mlcs4.x86_64.rpm
 8f456c326e0ac2db0290e56a879fd36f  corporate/4.0/x86_64/telnet-client-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
 6b03225e622b79b79dac29329f44be8f  corporate/4.0/x86_64/telnet-server-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm 
 386f1a12a9e0b1ec1b3d3bebbad29364  corporate/4.0/SRPMS/krb5-1.4.3-5.4.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFG4DIumqjQ0CJFipgRAoMCAKCP7mybpa/WuUVOJmWXIF11rRv17QCgqDxw
dwEa1dMKhoKDNcjYyoHiGrU=
=2rLi
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/