MDVSA-2008:209
- Package name
- pam_krb5
- Date
- 2008-10-03
- Advisory ID
- MDVSA-2008:209
- Affected versions
- 2008.0 i586 , 2007.1 i586 , 2008.0 x86_64 , 2008.1 x86_64 , 2008.1 i586 , 2007.1 x86_64
Problem description
Stéphane Bertin discovered a flaw in the pam_krb5 existing_ticket
configuration option where, if enabled and using an existing credential
cache, it was possible for a local user to gain elevated privileges
by using a different, local user's credential cache (CVE-2008-3825).
The updated packages have been patched to prevent this issue.
Updated packages
2008.0 i586
d5d6796b990f19316ee7a53d87745d63 2008.0/i586/pam_krb5-2.2.11-2.1mdv2008.0.i586.rpm 8b2d51b298306d43dfde2fe6f9cb0860 2008.0/SRPMS/pam_krb5-2.2.11-2.1mdv2008.0.src.rpm
2007.1 i586
92901a92d669d10831a2357da8ac3ff8 2007.1/i586/pam_krb5-2.2.11-2.1mdv2007.1.i586.rpm e8ba90e174669b8b43bf0bbf9c61831f 2007.1/SRPMS/pam_krb5-2.2.11-2.1mdv2007.1.src.rpm
2008.0 x86_64
5cb8c3f5768cdc475bfa81e14244856b 2008.0/x86_64/pam_krb5-2.2.11-2.1mdv2008.0.x86_64.rpm 8b2d51b298306d43dfde2fe6f9cb0860 2008.0/SRPMS/pam_krb5-2.2.11-2.1mdv2008.0.src.rpm
2008.1 x86_64
d07f560edf337af6279a888fd695aa49 2008.1/x86_64/pam_krb5-2.2.11-2.1mdv2008.1.x86_64.rpm 2d1f96e821e05ddba6ffe3d1cee2247b 2008.1/SRPMS/pam_krb5-2.2.11-2.1mdv2008.1.src.rpm
2008.1 i586
2d30041830c5c3db19a23e096a968426 2008.1/i586/pam_krb5-2.2.11-2.1mdv2008.1.i586.rpm 2d1f96e821e05ddba6ffe3d1cee2247b 2008.1/SRPMS/pam_krb5-2.2.11-2.1mdv2008.1.src.rpm
2007.1 x86_64
63e366f352ed36d5e6b7b87a84d25d33 2007.1/x86_64/pam_krb5-2.2.11-2.1mdv2007.1.x86_64.rpm e8ba90e174669b8b43bf0bbf9c61831f 2007.1/SRPMS/pam_krb5-2.2.11-2.1mdv2007.1.src.rpm