MDVSA-2011:117
- Nom du paquet
- krb5-appl
- Date
- 2011-07-22
- Advisory ID
- MDVSA-2011:117
- Affected versions
- MES5 i586 , MES5 x86_64 , 2010.1 i586 , 2010.1 x86_64
Problem description
A vulnerability was discovered and corrected in krb5-appl:
ftpd.c in the GSS-API FTP daemon in MIT Kerberos Version 5 Applications
(aka krb5-appl) 1.0.1 and earlier does not check the krb5_setegid
return value, which allows remote authenticated users to bypass
intended group access restrictions, and create, overwrite, delete,
or read files, via standard FTP commands, related to missing autoconf
tests in a configure script (CVE-2011-1526).
The updated packages have been patched to correct this issue.
Updated packages
MES5 i586
ed220f370dd54abd37f827b0d093b202 mes5/i586/krb5-appl-clients-1.0-0.3mdvmes5.2.i586.rpm f0cc53b9afb94ac7a8862fc7eb44ac9f mes5/i586/krb5-appl-servers-1.0-0.3mdvmes5.2.i586.rpm cfb068705089f1969b4d79ae7ca72da2 mes5/SRPMS/krb5-appl-1.0-0.3mdvmes5.2.src.rpm
MES5 x86_64
d89328c56f8ad81f6348fc6be437c219 mes5/x86_64/krb5-appl-clients-1.0-0.3mdvmes5.2.x86_64.rpm 3b5b97cd34da9d62574251ba540d64e5 mes5/x86_64/krb5-appl-servers-1.0-0.3mdvmes5.2.x86_64.rpm cfb068705089f1969b4d79ae7ca72da2 mes5/SRPMS/krb5-appl-1.0-0.3mdvmes5.2.src.rpm
2010.1 i586
90a608dbdda5554f01ac2d136858550b 2010.1/i586/krb5-appl-clients-1.0-4.1mdv2010.2.i586.rpm aeea1b673b042a3c7f534fc455985487 2010.1/i586/krb5-appl-servers-1.0-4.1mdv2010.2.i586.rpm 042d96c34567bb41c7b0eedfa2108955 2010.1/SRPMS/krb5-appl-1.0-4.1mdv2010.2.src.rpm
2010.1 x86_64
18e51ba0b42949c6b8663fe854dccfef 2010.1/x86_64/krb5-appl-clients-1.0-4.1mdv2010.2.x86_64.rpm 041173a8ed33ad691481c89fcd71e76e 2010.1/x86_64/krb5-appl-servers-1.0-4.1mdv2010.2.x86_64.rpm 042d96c34567bb41c7b0eedfa2108955 2010.1/SRPMS/krb5-appl-1.0-4.1mdv2010.2.src.rpm