Package name
krb5
Date
2007-09-06
Advisory ID
MDKSA-2007:174
Affected versions
2007.0 x86_64 , 2007.1 i586 , 2007.0 i586 , CS4.0 i586 , CS4.0 x86_64 , 2007.1 x86_64

Problem description

A stack buffer overflow vulnerability was discovered in the RPC
library used by Kerberos' kadmind program by Tenable Network Security.
A remote unauthenticated user who could access kadmind would be
able to trigger the flaw and cause it to crash (CVE-2007-3999).
This issue is only applicable to Kerberos 1.4 and higher.

Garrett Wollman found an uninitialized pointer vulnerability in
kadmind which a remote unauthenticated attacker able to access
kadmind could exploit to cause kadmind to crash (CVE-2007-4000).
This issue is only applicable to Kerberos 1.5 and higher.

Updated packages have been patched to prevent these issues.

Updated packages

2007.0 x86_64

 31a2e9d08030fdccf17966aaca4c2bc0  2007.0/x86_64/ftp-client-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
 e57f555390d1f003cbdc0d1cb72e7c4f  2007.0/x86_64/ftp-server-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
 217e0f42dd10aebb632f033759c47ebc  2007.0/x86_64/krb5-server-1.4.3-7.2mdv2007.0.x86_64.rpm
 2980773dbc6b1f6683b95aba97c35cd5  2007.0/x86_64/krb5-workstation-1.4.3-7.2mdv2007.0.x86_64.rpm
 f5088e63f308401668d57c55f0b77ff0  2007.0/x86_64/lib64krb53-1.4.3-7.2mdv2007.0.x86_64.rpm
 8ab20c05069706f52d38e66ebb9eff0d  2007.0/x86_64/lib64krb53-devel-1.4.3-7.2mdv2007.0.x86_64.rpm
 320f85004ccd12c7f2d5a60390f82f92  2007.0/x86_64/telnet-client-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm
 0034ab03a2b730b1579d7b6c7441943d  2007.0/x86_64/telnet-server-krb5-1.4.3-7.2mdv2007.0.x86_64.rpm 
 d2df6f0bb9bba3b73e08f7b1ee864663  2007.0/SRPMS/krb5-1.4.3-7.2mdv2007.0.src.rpm

2007.1 i586

 b1393ec2d736fe5cfc3839c10cfcd4c9  2007.1/i586/ftp-client-krb5-1.5.2-6.4mdv2007.1.i586.rpm
 376e94532ed6ff26af47ea67907b508a  2007.1/i586/ftp-server-krb5-1.5.2-6.4mdv2007.1.i586.rpm
 86ece0868f36205ae22e82fb9a224c6f  2007.1/i586/krb5-server-1.5.2-6.4mdv2007.1.i586.rpm
 b92b05b3fcb8596128f22628a8c0978f  2007.1/i586/krb5-workstation-1.5.2-6.4mdv2007.1.i586.rpm
 2ac3a21378e1cba303bf45cbdae4a702  2007.1/i586/libkrb53-1.5.2-6.4mdv2007.1.i586.rpm
 c5d5fca0cac517bdf4b2aee7bb4cd093  2007.1/i586/libkrb53-devel-1.5.2-6.4mdv2007.1.i586.rpm
 e41bec65196a1f8c8d29d57202722c1e  2007.1/i586/telnet-client-krb5-1.5.2-6.4mdv2007.1.i586.rpm
 644d21f340462d6ed9ef06ef51f80a9b  2007.1/i586/telnet-server-krb5-1.5.2-6.4mdv2007.1.i586.rpm 
 5969e680e558cdbfb5bd58d2055e6690  2007.1/SRPMS/krb5-1.5.2-6.4mdv2007.1.src.rpm

2007.0 i586

 fee98286370dd34c8f046490d6555179  2007.0/i586/ftp-client-krb5-1.4.3-7.2mdv2007.0.i586.rpm
 50456e1353b3e8264212aabf8bb2cf25  2007.0/i586/ftp-server-krb5-1.4.3-7.2mdv2007.0.i586.rpm
 d7a788cedbf5e43211c3ccae8e2b43ec  2007.0/i586/krb5-server-1.4.3-7.2mdv2007.0.i586.rpm
 da25460534678debf299f891d3124c6d  2007.0/i586/krb5-workstation-1.4.3-7.2mdv2007.0.i586.rpm
 6c5574daaf8bd22b219d2146a2305f96  2007.0/i586/libkrb53-1.4.3-7.2mdv2007.0.i586.rpm
 342de2dacfdb04349bc6f67303e9a284  2007.0/i586/libkrb53-devel-1.4.3-7.2mdv2007.0.i586.rpm
 da4e9f106fc6a84ab6715df1a0682811  2007.0/i586/telnet-client-krb5-1.4.3-7.2mdv2007.0.i586.rpm
 bd6d217f5d1b7f2fbbef88500b397778  2007.0/i586/telnet-server-krb5-1.4.3-7.2mdv2007.0.i586.rpm 
 d2df6f0bb9bba3b73e08f7b1ee864663  2007.0/SRPMS/krb5-1.4.3-7.2mdv2007.0.src.rpm

CS4.0 i586

 b53ae6dc0c6e135d21f3e2402c3604b4  corporate/4.0/i586/ftp-client-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
 2974c7afde71976f7f32ecdf6356d919  corporate/4.0/i586/ftp-server-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
 90822e6a2279b6e9965d4da422683fb8  corporate/4.0/i586/krb5-server-1.4.3-5.4.20060mlcs4.i586.rpm
 e922c9cf5476b1a703e9f871ea49de9e  corporate/4.0/i586/krb5-workstation-1.4.3-5.4.20060mlcs4.i586.rpm
 407cb4131f21787e24e2cfd72f022bbd  corporate/4.0/i586/libkrb53-1.4.3-5.4.20060mlcs4.i586.rpm
 3904b3610e52c7f1dc8dc94fdd01d1cd  corporate/4.0/i586/libkrb53-devel-1.4.3-5.4.20060mlcs4.i586.rpm
 5159251a5bd64eb90ffcadff2d0d4f54  corporate/4.0/i586/telnet-client-krb5-1.4.3-5.4.20060mlcs4.i586.rpm
 4b6e9fa7c7fa2510313fc7daa7c807ef  corporate/4.0/i586/telnet-server-krb5-1.4.3-5.4.20060mlcs4.i586.rpm 
 386f1a12a9e0b1ec1b3d3bebbad29364  corporate/4.0/SRPMS/krb5-1.4.3-5.4.20060mlcs4.src.rpm

CS4.0 x86_64

 c0607489bfa9a184a351e594931d0503  corporate/4.0/x86_64/ftp-client-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
 8a4f1b09bd10f8ca3e66a8a1757f5584  corporate/4.0/x86_64/ftp-server-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
 f7f0e7e946a789cfaaf8ac6cf300cd13  corporate/4.0/x86_64/krb5-server-1.4.3-5.4.20060mlcs4.x86_64.rpm
 19570fc019ca743b748827db346e5e78  corporate/4.0/x86_64/krb5-workstation-1.4.3-5.4.20060mlcs4.x86_64.rpm
 b7f69a12ec4e3c8b2e21ecd9a38188d5  corporate/4.0/x86_64/lib64krb53-1.4.3-5.4.20060mlcs4.x86_64.rpm
 07945ad05c2de8bbb291892dca8fbdbb  corporate/4.0/x86_64/lib64krb53-devel-1.4.3-5.4.20060mlcs4.x86_64.rpm
 8f456c326e0ac2db0290e56a879fd36f  corporate/4.0/x86_64/telnet-client-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm
 6b03225e622b79b79dac29329f44be8f  corporate/4.0/x86_64/telnet-server-krb5-1.4.3-5.4.20060mlcs4.x86_64.rpm 
 386f1a12a9e0b1ec1b3d3bebbad29364  corporate/4.0/SRPMS/krb5-1.4.3-5.4.20060mlcs4.src.rpm

2007.1 x86_64

 c868cf665ae10b05a31fd6475c58ae24  2007.1/x86_64/ftp-client-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
 a11d2830886a2965e611685b7adeac60  2007.1/x86_64/ftp-server-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
 cb4cab90ad5cafdf6ad4bfc2ffcf9728  2007.1/x86_64/krb5-server-1.5.2-6.4mdv2007.1.x86_64.rpm
 6569749360719e87fc5ba20a29d4fed6  2007.1/x86_64/krb5-workstation-1.5.2-6.4mdv2007.1.x86_64.rpm
 09dfc1222a6ea1bbed684cf91d285792  2007.1/x86_64/lib64krb53-1.5.2-6.4mdv2007.1.x86_64.rpm
 1e923fae2747da542674664f6675728b  2007.1/x86_64/lib64krb53-devel-1.5.2-6.4mdv2007.1.x86_64.rpm
 060abbb082e448be1906a76b69dd1434  2007.1/x86_64/telnet-client-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm
 0b6c65e34e4bd42328206a6cebf15b34  2007.1/x86_64/telnet-server-krb5-1.5.2-6.4mdv2007.1.x86_64.rpm 
 5969e680e558cdbfb5bd58d2055e6690  2007.1/SRPMS/krb5-1.5.2-6.4mdv2007.1.src.rpm

References