Paketname
krb5-appl
Datum
2011-07-22
Advisory ID
MDVSA-2011:117
Betroffene Versionen
MES5 i586 , MES5 x86_64 , 2010.1 i586 , 2010.1 x86_64

Problembeschreibung

A vulnerability was discovered and corrected in krb5-appl:

ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications
(aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid
return value, which allows remote authenticated users to bypass
intended group access restrictions, and create, overwrite, delete,
or read files, via standard FTP commands, related to missing autoconf
tests in a configure script (CVE-2011-1526).

The updated packages have been patched to correct this issue.

Aktualisierte Pakete

MES5 i586

 ed220f370dd54abd37f827b0d093b202  mes5/i586/krb5-appl-clients-1.0-0.3mdvmes5.2.i586.rpm
 f0cc53b9afb94ac7a8862fc7eb44ac9f  mes5/i586/krb5-appl-servers-1.0-0.3mdvmes5.2.i586.rpm 
 cfb068705089f1969b4d79ae7ca72da2  mes5/SRPMS/krb5-appl-1.0-0.3mdvmes5.2.src.rpm

MES5 x86_64

 d89328c56f8ad81f6348fc6be437c219  mes5/x86_64/krb5-appl-clients-1.0-0.3mdvmes5.2.x86_64.rpm
 3b5b97cd34da9d62574251ba540d64e5  mes5/x86_64/krb5-appl-servers-1.0-0.3mdvmes5.2.x86_64.rpm 
 cfb068705089f1969b4d79ae7ca72da2  mes5/SRPMS/krb5-appl-1.0-0.3mdvmes5.2.src.rpm

2010.1 i586

 90a608dbdda5554f01ac2d136858550b  2010.1/i586/krb5-appl-clients-1.0-4.1mdv2010.2.i586.rpm
 aeea1b673b042a3c7f534fc455985487  2010.1/i586/krb5-appl-servers-1.0-4.1mdv2010.2.i586.rpm 
 042d96c34567bb41c7b0eedfa2108955  2010.1/SRPMS/krb5-appl-1.0-4.1mdv2010.2.src.rpm

2010.1 x86_64

 18e51ba0b42949c6b8663fe854dccfef  2010.1/x86_64/krb5-appl-clients-1.0-4.1mdv2010.2.x86_64.rpm
 041173a8ed33ad691481c89fcd71e76e  2010.1/x86_64/krb5-appl-servers-1.0-4.1mdv2010.2.x86_64.rpm 
 042d96c34567bb41c7b0eedfa2108955  2010.1/SRPMS/krb5-appl-1.0-4.1mdv2010.2.src.rpm

Referenzen