-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : krb5 SUMMARY : Several Kerberos vulnerabilities DATE : 2003-05-05 16:23:00 ID : CLA-2003:639 RELEVANT RELEASES : 8 - ------------------------------------------------------------------------- DESCRIPTION The "krb5" packages are MIT's[1] implementation of the Kerberos 5 authentication protocol. This update fixes the vulnerabilities outlined below: 1. Principal name handling vulnerabilities[2] (CAN-2003-0082[3] and CAN-2003-0072[4]) Nalin Dahyabhai discovered buffer overrun and underrun problems in the code that handles Kerberos principal names. When presented with some unusual names, such as names with zero components, names with one empty component, or host-based service principal names with no host name component, at least a program crash would result. 2. Cryptographic weaknesses in Kerberos v4 protocol[5] (CAN-2003-0138[6] and CAN-2003-0139[7]) A weakness in the Kerberos v4 protocol allows an attacker to impersonate any principal in a realm. If done against cross-realm principals, such an attack could lead to the compromise of other realms which share a cross-realm key with the local realm. This update disabled Kerberos 4 cross-realm authentication by default. Additionally, MIT's implementation of the Kerberos 4 protocol included in the krb5 package allow an attacker to fabricate krb4 tickets if 3DES keys are used. 3. Faulty length checks in xdrmem_getbytes[8] (CAN-2003-0028[9]) The xdrmem_*() family of functions (such as xdrmem_getbytes()) from the XDR library used by MIT Kerberos contains integer overflows that may be exploited by remote (but authenticated) attackers to cause a denial of service condition or even expose sensitive information. 4. Multiple vulnerabilities in old releases of MIT Kerberos[10] - ASN.1 decoding flaw[11]: the ASN.1 decoder contains integer signedness errors which could be used by remote attackers to crash the program; - KDC null pointer dereference[12]: a remote attacker could make the KDC attempt to dereference a NULL pointer, resulting in a program crash and a denial of service condition; - Inter-realm user impersonation[13] and format string vulnerability[14] (cited in MIT's advisory but already fixed in our previous 1.2.3 package) This announcement upgrades the Kerberos packages in Conectiva Linux 8 to the 1.2.8 version. Please note that Conectiva Linux 9 includes a patched 1.2.7 version and is not vulnerable to these issues. SOLUTION It is recommended that all Kerberos users in Conectiva Linux 8 upgrade their packages. Please note that the service will be automatically restarted after the upgrade if it was already running. Several applications can make use of the Kerberos libraries. It is recommended that those applications be restarted as well. A list of such applications can be obtained right after the upgrade by running the following command: lsof | grep \; REFERENCES 1.http://web.mit.edu/Kerberos/www/index.html 2.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-005-buf.txt 3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0082 4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0072 5.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-004-krb4.txt 6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0138 7.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0139 8.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-003-xdr.txt 9.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0028 10.http://web.mit.edu/Kerberos/www/advisories/MITKRB5-SA-2003-001-multiple.txt 11.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0036 12.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0058 13.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0059 14.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0060 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/8/SRPMS/krb5-1.2.8-1U80_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-1.2.8-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-apps-clients-1.2.8-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-apps-servers-1.2.8-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-client-1.2.8-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-devel-1.2.8-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-devel-static-1.2.8-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-doc-1.2.8-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/krb5-server-1.2.8-1U80_1cl.i386.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- Copyright (c) 2003 Conectiva Inc. http://www.conectiva.com - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribeat_private unsubscribe: conectiva-updates-unsubscribeat_private -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+trqi42jd0JmAcZARAo1VAKCp14kfkJw+7tIh8/HNx8XqUD8P4ACgpZ/E LF+Uk/oc3zdBbrEcD3Y+5PU= =T48R -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Mon May 05 2003 - 12:49:51 PDT