MDVSA-2010:129
- Package name
- heimdal
- Date
- 2010-07-07
- Advisory ID
- MDVSA-2010:129
- Affected versions
- CS4.0 x86_64 , CS4.0 i586
Problem description
Multiple vulnerabilities has been found and corrected in heimdal:
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5)
up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and
(b) Heimdal 0.7.2 and earlier, do not check return codes for setuid
calls, which allows local users to gain privileges by causing setuid
to fail to drop privileges using attacks such as resource exhaustion
(CVE-2006-3083).
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to
1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not
check return codes for setuid calls, which might allow local users to
gain privileges by causing setuid to fail to drop privileges. NOTE:
as of 20060808, it is not known whether an exploitable attack scenario
exists for these issues (CVE-2006-3084).
Certain invalid GSS-API tokens can cause a GSS-API acceptor (server)
to crash due to a null pointer dereference in the GSS-API library
(CVE-2010-1321).
The updated packages have been patched to correct these issues.
Updated packages
CS4.0 x86_64
0e9e08ac49551bd485d7ec6e7881f90d corporate/4.0/x86_64/heimdal-devel-0.7.2-8.2.20060mlcs4.x86_64.rpm 0f4913fc15f0df07888b3e66ab7d68be corporate/4.0/x86_64/heimdal-libs-0.7.2-8.2.20060mlcs4.x86_64.rpm d3b6d5225757d3eea52e0aabca3d3a7a corporate/4.0/x86_64/heimdal-server-0.7.2-8.2.20060mlcs4.x86_64.rpm 889807bdaa224a44c9d63eb03f66738b corporate/4.0/x86_64/heimdal-workstation-0.7.2-8.2.20060mlcs4.x86_64.rpm 0e185a5ad5f4c522c39c02991f220313 corporate/4.0/SRPMS/heimdal-0.7.2-8.2.20060mlcs4.src.rpm
CS4.0 i586
508353086c607e0cb578ac646ca15c0c corporate/4.0/i586/heimdal-devel-0.7.2-8.2.20060mlcs4.i586.rpm 4c5b0d48fa172bb8e39aaccf5ae8de0c corporate/4.0/i586/heimdal-libs-0.7.2-8.2.20060mlcs4.i586.rpm 638c167a2e00722c131141154c78c3ae corporate/4.0/i586/heimdal-server-0.7.2-8.2.20060mlcs4.i586.rpm d3d008362cb8e289a3fd0314036a8d17 corporate/4.0/i586/heimdal-workstation-0.7.2-8.2.20060mlcs4.i586.rpm 0e185a5ad5f4c522c39c02991f220313 corporate/4.0/SRPMS/heimdal-0.7.2-8.2.20060mlcs4.src.rpm