-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
________________________________________________________________________
Mandrake Linux Security Update Advisory
________________________________________________________________________
Package name: krb5
Advisory ID: MDKSA-2002:073-1
Date: January 13th, 2003
Original Advisory Date: October 29th, 2002
Affected versions: 8.1, 8.2, 9.0
________________________________________________________________________
Problem Description:
A stack buffer overflow in the implementation of the Kerberos v4
compatibility administration daemon (kadmind4) in the krb5 package can
be exploited to gain unauthorized root access to a KDC host.
Authentication to the daemon is not required to successfully perform
the attack and according to MIT at least one exploit is known to exist.
kadmind4 is used only by sites that require compatibility with legacy
administrative clients, and sites that do not have these needs are
likely not using kadmind4 and are not affected.
MandrakeSoft encourages all users who use Kerberos to upgrade to these
packages immediately.
Update:
The /etc/rc.d/init.d/kadmin initscript improperly pointed to a non-existant
location for the kadmind binary. This update corrects the problem.
________________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
http://www.kb.cert.org/vuls/id/875073
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-002-kadm4.txt
________________________________________________________________________
Updated Packages:
Mandrake Linux 8.1:
323c794946dd2d0795ec5f1eb60994b8 8.1/RPMS/ftp-client-krb5-1.2.2-17.3mdk.i586.rpm
c0196c5b5451974c038601f04295ec54 8.1/RPMS/ftp-server-krb5-1.2.2-17.3mdk.i586.rpm
58a6df02b3358a3ee0bb220c4e71d933 8.1/RPMS/krb5-devel-1.2.2-17.3mdk.i586.rpm
f77670644538cb06aa58456a95f20a27 8.1/RPMS/krb5-libs-1.2.2-17.3mdk.i586.rpm
04341f6d04e6a5a2be59bc50b3d25614 8.1/RPMS/krb5-server-1.2.2-17.3mdk.i586.rpm
188419822f768861a658ed55bca08ef1 8.1/RPMS/krb5-workstation-1.2.2-17.3mdk.i586.rpm
e86a979d495096ad3c75f912f9e632c9 8.1/RPMS/telnet-client-krb5-1.2.2-17.3mdk.i586.rpm
0c236fb51882705aa218ae6601a33ce9 8.1/RPMS/telnet-server-krb5-1.2.2-17.3mdk.i586.rpm
263f5558dfc4152252648ca070a7eb40 8.1/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrake Linux 8.1/IA64:
61ba3f9c8583eccdaed9661afd9c04c0 ia64/8.1/RPMS/ftp-client-krb5-1.2.2-17.3mdk.ia64.rpm
7abe524e1f342356d8893003140d273f ia64/8.1/RPMS/ftp-server-krb5-1.2.2-17.3mdk.ia64.rpm
3770ada21a568ca3e76475211a1af531 ia64/8.1/RPMS/krb5-devel-1.2.2-17.3mdk.ia64.rpm
487c2dd3414fd168b2b5487c77c8b1d7 ia64/8.1/RPMS/krb5-libs-1.2.2-17.3mdk.ia64.rpm
931e557cabbf684162b8156af23c70d1 ia64/8.1/RPMS/krb5-server-1.2.2-17.3mdk.ia64.rpm
0947d63f85c4aaf920880e75e477263b ia64/8.1/RPMS/krb5-workstation-1.2.2-17.3mdk.ia64.rpm
950412bff51b20583e28866e9c3ea6d6 ia64/8.1/RPMS/telnet-client-krb5-1.2.2-17.3mdk.ia64.rpm
52e2040c7fed7758c336c2385dae336a ia64/8.1/RPMS/telnet-server-krb5-1.2.2-17.3mdk.ia64.rpm
263f5558dfc4152252648ca070a7eb40 ia64/8.1/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrake Linux 8.2:
440d915e6b39d5fca0079299f35227ab 8.2/RPMS/ftp-client-krb5-1.2.2-17.3mdk.i586.rpm
073ab9ee421ef1a39b0d71bb4d65695b 8.2/RPMS/ftp-server-krb5-1.2.2-17.3mdk.i586.rpm
fd42b8f5ae9b1940214f8284ecce8274 8.2/RPMS/krb5-devel-1.2.2-17.3mdk.i586.rpm
f641f6ec0d85ea699b77689310ac298d 8.2/RPMS/krb5-libs-1.2.2-17.3mdk.i586.rpm
b5e881e185014763d07c5a401eb9ab95 8.2/RPMS/krb5-server-1.2.2-17.3mdk.i586.rpm
05ff68b0a8208b9758fe5f5f9c59d8f8 8.2/RPMS/krb5-workstation-1.2.2-17.3mdk.i586.rpm
a1956d454a10c780b6b24759494019fe 8.2/RPMS/telnet-client-krb5-1.2.2-17.3mdk.i586.rpm
c3d93d81d7cea0c3d861ebd790ad2fe2 8.2/RPMS/telnet-server-krb5-1.2.2-17.3mdk.i586.rpm
263f5558dfc4152252648ca070a7eb40 8.2/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrake Linux 8.2/PPC:
7489a4a40a72a3c7d0ac23cd91b1c623 ppc/8.2/RPMS/ftp-client-krb5-1.2.2-17.3mdk.ppc.rpm
80ef86c8530ee200f973d9d2e23f0563 ppc/8.2/RPMS/ftp-server-krb5-1.2.2-17.3mdk.ppc.rpm
55fcdb4d7d49719cd64e468f8e33da41 ppc/8.2/RPMS/krb5-devel-1.2.2-17.3mdk.ppc.rpm
704fd62b4d69ff45ab093e3bd9ab4b04 ppc/8.2/RPMS/krb5-libs-1.2.2-17.3mdk.ppc.rpm
d120b6b498a9cc592bc29d60b11648ed ppc/8.2/RPMS/krb5-server-1.2.2-17.3mdk.ppc.rpm
a29782b7b6b2f7820cfe2af125465efb ppc/8.2/RPMS/krb5-workstation-1.2.2-17.3mdk.ppc.rpm
9f87d4e92c916acf97ae176b259d726f ppc/8.2/RPMS/telnet-client-krb5-1.2.2-17.3mdk.ppc.rpm
37e638bcdc5c7bfd2c967a81a8cae105 ppc/8.2/RPMS/telnet-server-krb5-1.2.2-17.3mdk.ppc.rpm
263f5558dfc4152252648ca070a7eb40 ppc/8.2/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrake Linux 9.0:
1fd196b2cbf84fb58bcb9fa83d1b3d71 9.0/RPMS/ftp-client-krb5-1.2.5-1.2mdk.i586.rpm
b6bb6b48289cc350180e743373d8ea35 9.0/RPMS/ftp-server-krb5-1.2.5-1.2mdk.i586.rpm
95628f75c909f201c986c647b293b597 9.0/RPMS/krb5-devel-1.2.5-1.2mdk.i586.rpm
4b1ce4edcc5c73b567131a2e3f8633f5 9.0/RPMS/krb5-libs-1.2.5-1.2mdk.i586.rpm
d80438ee2e192b45416a8f849e7047b2 9.0/RPMS/krb5-server-1.2.5-1.2mdk.i586.rpm
a23ab952296f74b9dad7f7fc0404e5c0 9.0/RPMS/krb5-workstation-1.2.5-1.2mdk.i586.rpm
fdc950553fa7f3fcc200d5e9661c8d9b 9.0/RPMS/telnet-client-krb5-1.2.5-1.2mdk.i586.rpm
97a4e7e29404a7f49fe9f46f3397178e 9.0/RPMS/telnet-server-krb5-1.2.5-1.2mdk.i586.rpm
fd17b5fa3db51eeb35d7da87ea725ee1 9.0/SRPMS/krb5-1.2.5-1.2mdk.src.rpm
________________________________________________________________________
Bug IDs fixed (see https://qa.mandrakesoft.com for more information):
________________________________________________________________________
To upgrade automatically, use MandrakeUpdate. The verification of md5
checksums and GPG signatures is performed automatically for you.
If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". A list of
FTP mirrors can be obtained from:
http://www.mandrakesecure.net/en/ftp.php
Please verify the update prior to upgrading to ensure the integrity of
the downloaded package. You can do this with the command:
rpm --checksig <filename>
All packages are signed by MandrakeSoft for security. You can obtain
the GPG public key of the Mandrake Linux Security Team from:
https://www.mandrakesecure.net/RPM-GPG-KEYS
Please be aware that sometimes it takes the mirrors a few hours to
update.
You can view other update advisories for Mandrake Linux at:
http://www.mandrakesecure.net/en/advisories/
MandrakeSoft has several security-related mailing list services that
anyone can subscribe to. Information on these lists can be obtained by
visiting:
http://www.mandrakesecure.net/en/mlist.php
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
<security linux-mandrake.com>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.7 (GNU/Linux)
mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPaIRgQQEQIA
BgUCPI+UAwAKCRDniYrgcHcf8xK5AKCm/Mq8qP8GE0o1hEX22QsJMZwH5gCfZ72H
8TacOb3oAmBdprf+K6gkdOiIRgQQEQIABgUCOtOieAAKCRCv2bZyU0yB80MeAJ9K
+jXt0cKuaUonRU+CRGetk6t9dgCfTRRL6/puOKdD6md70+K5EBBSvsG0OE1hbmRy
YWtlIExpbnV4IFNlY3VyaXR5IFRlYW0gPHNlY3VyaXR5QG1hbmRyYWtlc29mdC5j
b20+iFcEExECABcFAjyPnuUFCwcKAwQDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmFi+
AJsHhohgnU3ik4+gy3EdFlB2i/MBoACg6lHn5cnVvTcmgNccWxeNxLLZI5e5AQ0E
OWnn7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ
9F779FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzR
xBXVJb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z
269s+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN
6SCXVl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZ
jTcl3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo
0NAiRYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJ
EJGXlA==
=yGlX
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE+I6rKmqjQ0CJFipgRAvU6AJ453sfflrfM/CHWBQrKD2F59QRFjACeP05x
+ZfhnUJwpyfj9Z2jnrA441I=
=m7JW
-----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Tue Jan 21 2003 - 02:34:53 PST