MDKSA-2003:043

Package name
krb5
Date
2003-04-01
Advisory ID
MDKSA-2003:043
Affected versions
9.1 i586 , CS2.1 x86_64 , CS2.1 i586 , 9.0 i586 , 8.2 i586 , MNF8.2 i586 , 9.1 i586 , 8.2 i586

Problem description

Multiple vulnerabilties have been found in the Kerberos network authentication system. The MIT Kerberos team have released an advisory detailing these vulnerabilties, a description of which follows. An integer signedness error in the ASN.1 decoder before version 1.2.5 allows remote attackers to cause a crash of the server via a large unsigned data element length, which is later used as a negative value (CAN-2002-0036). Mandrake Linux 9.0+ is not affected by this problem. Vulnerabilties have been found in the RPC library used by the kadmin service. A faulty length check in the RPC library exposes kadmind to an integer overflow which can be used to crash kadmind (CAN-2003-0028). The KDC (Key Distribution Center) before version 1.2.5 allows remote, authenticated attackers to cause a crash on KDCs within the same realm using a certain protocol that causes a null dereference (CAN-2003-0058). Mandrake Linux 9.0+ is not affected by this problem. Users from one realm can impersonate users in other realms that have the same inter-realm keys due to a vulnerability in Kerberos 1.2.3 and earlier (CAN-2003-0059). Mandrake Linux 9.0+ is not affected by this problem. The KDC allows remote, authenticated users to cause a crash on KDCs within the same realm using a certain protocol request that causes an out-of-bounds read of an array (CAN-2003-0072). The KDC allows remote, authenticated users to cause a crash on KDCs within the same realm using a certain protocol request that causes the KDC to corrupt its heap (CAN-2003-0082). Vulnerabilities have been discovered in the Kerberos IV authentication protocol which allow an attacker with knowledge of a cross-realm key, which is shared in another realm, to impersonate a principle in that realm to any service in that realm. This vulnerability can only be closed by disabling cross-realm authentication in Kerberos IV (CAN-2003-0138). Vulnerabilities have been discovered in the support for triple-DES keys in the Kerberos IV authentication protocol which is included in MIT Kerberos (CAN-2003-0139). MandrakeSoft encourages all users to upgrade to these updated packages immediately which contain patches to correct all of the previously noted vulnerabilities. These packages also disable Kerberos IV cross-realm authentication by default.

Updated packages

9.1 i586

 b5888bcb397105c47541289de9ab123e  9.1/RPMS/ftp-client-krb5-1.2.7-1.1mdk.i586.rpm
eb5560bd11eeb6648528181ad08e7f48  9.1/RPMS/ftp-server-krb5-1.2.7-1.1mdk.i586.rpm
5bc475f74920c7a06af22dee2ef7cc9d  9.1/RPMS/krb5-devel-1.2.7-1.1mdk.i586.rpm
1169c020d1f61107955067cf4f1830fc  9.1/RPMS/krb5-libs-1.2.7-1.1mdk.i586.rpm
24e6126c8fc8830b3855bb6880c347f8  9.1/RPMS/krb5-server-1.2.7-1.1mdk.i586.rpm
16d43cf77c24e26bc9f05c2cbfc2ba46  9.1/RPMS/krb5-workstation-1.2.7-1.1mdk.i586.rpm
823c27610e62c7b57c4dac0bb25a1f31  9.1/RPMS/telnet-client-krb5-1.2.7-1.1mdk.i586.rpm
cfba29048f25817c4bd296def06f3bf2  9.1/RPMS/telnet-server-krb5-1.2.7-1.1mdk.i586.rpm
3767fc890e9bb238de9e86a4a954e51f  9.1/SRPMS/krb5-1.2.7-1.1mdk.src.rpm

CS2.1 x86_64

 95817b8d9f00730f8b6331257427918a  x86_64/corporate/2.1/RPMS/ftp-client-krb5-1.2.5-1.4mdk.x86_64.rpm
580dcfe9cb776997b8018e1cd2735da3  x86_64/corporate/2.1/RPMS/ftp-server-krb5-1.2.5-1.4mdk.x86_64.rpm
28d24fe27741edd23f833b448fdbf9a6  x86_64/corporate/2.1/RPMS/krb5-devel-1.2.5-1.4mdk.x86_64.rpm
7d6031e2423637848a3815efd33876a5  x86_64/corporate/2.1/RPMS/krb5-libs-1.2.5-1.4mdk.x86_64.rpm
79fe9183373294a20e3f762e19b418d6  x86_64/corporate/2.1/RPMS/krb5-server-1.2.5-1.4mdk.x86_64.rpm
b086a588576145a4d1236ebc65c2a305  x86_64/corporate/2.1/RPMS/krb5-workstation-1.2.5-1.4mdk.x86_64.rpm
b3770027b905a2d5c28df54c483ebc8d  x86_64/corporate/2.1/RPMS/telnet-client-krb5-1.2.5-1.4mdk.x86_64.rpm
4ac227a6e1cff45cbfc43863be3d1392  x86_64/corporate/2.1/RPMS/telnet-server-krb5-1.2.5-1.4mdk.x86_64.rpm
78ea5596dfae26c7eeabcc25363850eb  x86_64/corporate/2.1/SRPMS/krb5-1.2.5-1.4mdk.src.rpm

CS2.1 i586

 ff044a2e3b1fa2c6b6a3f8567700bacc  corporate/2.1/RPMS/ftp-client-krb5-1.2.5-1.4mdk.i586.rpm
c9b9190ecdcb4afc7d235a4d14acccfb  corporate/2.1/RPMS/ftp-server-krb5-1.2.5-1.4mdk.i586.rpm
32ba407c1aef46b95cd9132fb7bc60a8  corporate/2.1/RPMS/krb5-devel-1.2.5-1.4mdk.i586.rpm
2a32898602de8551967c38414884e91c  corporate/2.1/RPMS/krb5-libs-1.2.5-1.4mdk.i586.rpm
b09f0544b8a685ec351ba0cbd18ed8aa  corporate/2.1/RPMS/krb5-server-1.2.5-1.4mdk.i586.rpm
bd412c5533f4fbcd216c96693122d798  corporate/2.1/RPMS/krb5-workstation-1.2.5-1.4mdk.i586.rpm
eaf68d6ef678c4400cbdec38493f6a32  corporate/2.1/RPMS/telnet-client-krb5-1.2.5-1.4mdk.i586.rpm
e9ffe51915f095ed19ff83b95a16be7f  corporate/2.1/RPMS/telnet-server-krb5-1.2.5-1.4mdk.i586.rpm
78ea5596dfae26c7eeabcc25363850eb  corporate/2.1/SRPMS/krb5-1.2.5-1.4mdk.src.rpm

9.0 i586

 ff044a2e3b1fa2c6b6a3f8567700bacc  9.0/RPMS/ftp-client-krb5-1.2.5-1.4mdk.i586.rpm
c9b9190ecdcb4afc7d235a4d14acccfb  9.0/RPMS/ftp-server-krb5-1.2.5-1.4mdk.i586.rpm
32ba407c1aef46b95cd9132fb7bc60a8  9.0/RPMS/krb5-devel-1.2.5-1.4mdk.i586.rpm
2a32898602de8551967c38414884e91c  9.0/RPMS/krb5-libs-1.2.5-1.4mdk.i586.rpm
b09f0544b8a685ec351ba0cbd18ed8aa  9.0/RPMS/krb5-server-1.2.5-1.4mdk.i586.rpm
bd412c5533f4fbcd216c96693122d798  9.0/RPMS/krb5-workstation-1.2.5-1.4mdk.i586.rpm
eaf68d6ef678c4400cbdec38493f6a32  9.0/RPMS/telnet-client-krb5-1.2.5-1.4mdk.i586.rpm
e9ffe51915f095ed19ff83b95a16be7f  9.0/RPMS/telnet-server-krb5-1.2.5-1.4mdk.i586.rpm
78ea5596dfae26c7eeabcc25363850eb  9.0/SRPMS/krb5-1.2.5-1.4mdk.src.rpm

8.2 i586

 819b0b7829b0ab6f0ffa03981bcb113b  8.2/RPMS/ftp-client-krb5-1.2.2-17.5mdk.i586.rpm
78238c5be9024658c709b660a27d86b1  8.2/RPMS/ftp-server-krb5-1.2.2-17.5mdk.i586.rpm
7484f3fffb575234257fecd38ab399b6  8.2/RPMS/krb5-devel-1.2.2-17.5mdk.i586.rpm
05f945beb43d5d7eef33513714bed38b  8.2/RPMS/krb5-libs-1.2.2-17.5mdk.i586.rpm
7989b492dc7282ccc1b4ea07461f81d5  8.2/RPMS/krb5-server-1.2.2-17.5mdk.i586.rpm
87e3129f28b44deee2afb579fc1aba44  8.2/RPMS/krb5-workstation-1.2.2-17.5mdk.i586.rpm
d577b4d921592ce650aa6143ddeecbcd  8.2/RPMS/telnet-client-krb5-1.2.2-17.5mdk.i586.rpm
2c27ad5354c7d46ef423d69472e38fc6  8.2/RPMS/telnet-server-krb5-1.2.2-17.5mdk.i586.rpm
d461701e513378feb8656c89653b29c2  8.2/SRPMS/krb5-1.2.2-17.5mdk.src.rpm

MNF8.2 i586

 05f945beb43d5d7eef33513714bed38b  mnf8.2/RPMS/krb5-libs-1.2.2-17.5mdk.i586.rpm
d461701e513378feb8656c89653b29c2  mnf8.2/SRPMS/krb5-1.2.2-17.5mdk.src.rpm

9.1 i586

 ff2ee32a87f4eb4d5d71fc141e07a653  ppc/9.1/RPMS/ftp-client-krb5-1.2.7-1.1mdk.ppc.rpm
d440d74811fbb8b639ed2beef6cb6183  ppc/9.1/RPMS/ftp-server-krb5-1.2.7-1.1mdk.ppc.rpm
ed860ab1279b3905e7a7b1f7bcd16cd3  ppc/9.1/RPMS/krb5-devel-1.2.7-1.1mdk.ppc.rpm
874113d397b64692cb5da3dac077b050  ppc/9.1/RPMS/krb5-libs-1.2.7-1.1mdk.ppc.rpm
e04607def631281fdd5adccf14957fff  ppc/9.1/RPMS/krb5-server-1.2.7-1.1mdk.ppc.rpm
d4125d6cd39eddd59e154669ac1d9cbc  ppc/9.1/RPMS/krb5-workstation-1.2.7-1.1mdk.ppc.rpm
5084b151cdbd8f9214c886c7a95f3e39  ppc/9.1/RPMS/telnet-client-krb5-1.2.7-1.1mdk.ppc.rpm
583b9695b76165a1d512de40cecc8e5c  ppc/9.1/RPMS/telnet-server-krb5-1.2.7-1.1mdk.ppc.rpm
3767fc890e9bb238de9e86a4a954e51f  ppc/9.1/SRPMS/krb5-1.2.7-1.1mdk.src.rpm

8.2 i586

 0c5028a103cecd754a6f506964bf4448  ppc/8.2/RPMS/ftp-client-krb5-1.2.2-17.5mdk.ppc.rpm
c68e111876b2320f24c1c22e8e6df1b1  ppc/8.2/RPMS/ftp-server-krb5-1.2.2-17.5mdk.ppc.rpm
fdffb190e2faacee2cf550c09d2aeabd  ppc/8.2/RPMS/krb5-devel-1.2.2-17.5mdk.ppc.rpm
d77d17bdfad6f0ee3e253ff55daeec91  ppc/8.2/RPMS/krb5-libs-1.2.2-17.5mdk.ppc.rpm
80a5e1fc2221a7ede39385da2defdad9  ppc/8.2/RPMS/krb5-server-1.2.2-17.5mdk.ppc.rpm
66adac55615ce0254222a1ea38847c69  ppc/8.2/RPMS/krb5-workstation-1.2.2-17.5mdk.ppc.rpm
809a854ca25dff7a3b8e29589b7bc7ea  ppc/8.2/RPMS/telnet-client-krb5-1.2.2-17.5mdk.ppc.rpm
4179fe8cd8b7a5f00cfad87bd07f341e  ppc/8.2/RPMS/telnet-server-krb5-1.2.2-17.5mdk.ppc.rpm
d461701e513378feb8656c89653b29c2  ppc/8.2/SRPMS/krb5-1.2.2-17.5mdk.src.rpm

References