Advisories
Mandriva Advisories
|
 |
| Problem Description |
A stack buffer overflow in the implementation of the Kerberos v4
compatibility administration daemon (kadmind4) in the krb5 package can
be exploited to gain unauthorized root access to a KDC host.
Authentication to the daemon is not required to successfully perform
the attack and according to MIT at least one exploit is known to exist.
kadmind4 is used only by sites that require compatibility with legacy
administrative clients, and sites that do not have these needs are
likely not using kadmind4 and are not affected.
MandrakeSoft encourages all users who use Kerberos to upgrade to these
packages immediately.
Update:
The /etc/rc.d/init.d/kadmin initscript improperly pointed to a non-existant
location for the kadmind binary. This update corrects the problem.
| Updated Packages |
Mandrakelinux 8.1
323c794946dd2d0795ec5f1eb60994b8 8.1/RPMS/ftp-client-krb5-1.2.2-17.3mdk.i586.rpm c0196c5b5451974c038601f04295ec54 8.1/RPMS/ftp-server-krb5-1.2.2-17.3mdk.i586.rpm 58a6df02b3358a3ee0bb220c4e71d933 8.1/RPMS/krb5-devel-1.2.2-17.3mdk.i586.rpm f77670644538cb06aa58456a95f20a27 8.1/RPMS/krb5-libs-1.2.2-17.3mdk.i586.rpm 04341f6d04e6a5a2be59bc50b3d25614 8.1/RPMS/krb5-server-1.2.2-17.3mdk.i586.rpm 188419822f768861a658ed55bca08ef1 8.1/RPMS/krb5-workstation-1.2.2-17.3mdk.i586.rpm e86a979d495096ad3c75f912f9e632c9 8.1/RPMS/telnet-client-krb5-1.2.2-17.3mdk.i586.rpm 0c236fb51882705aa218ae6601a33ce9 8.1/RPMS/telnet-server-krb5-1.2.2-17.3mdk.i586.rpm 263f5558dfc4152252648ca070a7eb40 8.1/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrakelinux 8.1/IA64
61ba3f9c8583eccdaed9661afd9c04c0 ia64/8.1/RPMS/ftp-client-krb5-1.2.2-17.3mdk.ia64.rpm 7abe524e1f342356d8893003140d273f ia64/8.1/RPMS/ftp-server-krb5-1.2.2-17.3mdk.ia64.rpm 3770ada21a568ca3e76475211a1af531 ia64/8.1/RPMS/krb5-devel-1.2.2-17.3mdk.ia64.rpm 487c2dd3414fd168b2b5487c77c8b1d7 ia64/8.1/RPMS/krb5-libs-1.2.2-17.3mdk.ia64.rpm 931e557cabbf684162b8156af23c70d1 ia64/8.1/RPMS/krb5-server-1.2.2-17.3mdk.ia64.rpm 0947d63f85c4aaf920880e75e477263b ia64/8.1/RPMS/krb5-workstation-1.2.2-17.3mdk.ia64.rpm 950412bff51b20583e28866e9c3ea6d6 ia64/8.1/RPMS/telnet-client-krb5-1.2.2-17.3mdk.ia64.rpm 52e2040c7fed7758c336c2385dae336a ia64/8.1/RPMS/telnet-server-krb5-1.2.2-17.3mdk.ia64.rpm 263f5558dfc4152252648ca070a7eb40 ia64/8.1/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrakelinux 8.2
440d915e6b39d5fca0079299f35227ab 8.2/RPMS/ftp-client-krb5-1.2.2-17.3mdk.i586.rpm 073ab9ee421ef1a39b0d71bb4d65695b 8.2/RPMS/ftp-server-krb5-1.2.2-17.3mdk.i586.rpm fd42b8f5ae9b1940214f8284ecce8274 8.2/RPMS/krb5-devel-1.2.2-17.3mdk.i586.rpm f641f6ec0d85ea699b77689310ac298d 8.2/RPMS/krb5-libs-1.2.2-17.3mdk.i586.rpm b5e881e185014763d07c5a401eb9ab95 8.2/RPMS/krb5-server-1.2.2-17.3mdk.i586.rpm 05ff68b0a8208b9758fe5f5f9c59d8f8 8.2/RPMS/krb5-workstation-1.2.2-17.3mdk.i586.rpm a1956d454a10c780b6b24759494019fe 8.2/RPMS/telnet-client-krb5-1.2.2-17.3mdk.i586.rpm c3d93d81d7cea0c3d861ebd790ad2fe2 8.2/RPMS/telnet-server-krb5-1.2.2-17.3mdk.i586.rpm 263f5558dfc4152252648ca070a7eb40 8.2/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrakelinux 8.2/PPC
7489a4a40a72a3c7d0ac23cd91b1c623 ppc/8.2/RPMS/ftp-client-krb5-1.2.2-17.3mdk.ppc.rpm 80ef86c8530ee200f973d9d2e23f0563 ppc/8.2/RPMS/ftp-server-krb5-1.2.2-17.3mdk.ppc.rpm 55fcdb4d7d49719cd64e468f8e33da41 ppc/8.2/RPMS/krb5-devel-1.2.2-17.3mdk.ppc.rpm 704fd62b4d69ff45ab093e3bd9ab4b04 ppc/8.2/RPMS/krb5-libs-1.2.2-17.3mdk.ppc.rpm d120b6b498a9cc592bc29d60b11648ed ppc/8.2/RPMS/krb5-server-1.2.2-17.3mdk.ppc.rpm a29782b7b6b2f7820cfe2af125465efb ppc/8.2/RPMS/krb5-workstation-1.2.2-17.3mdk.ppc.rpm 9f87d4e92c916acf97ae176b259d726f ppc/8.2/RPMS/telnet-client-krb5-1.2.2-17.3mdk.ppc.rpm 37e638bcdc5c7bfd2c967a81a8cae105 ppc/8.2/RPMS/telnet-server-krb5-1.2.2-17.3mdk.ppc.rpm 263f5558dfc4152252648ca070a7eb40 ppc/8.2/SRPMS/krb5-1.2.2-17.3mdk.src.rpm
Mandrakelinux 9.0
1fd196b2cbf84fb58bcb9fa83d1b3d71 9.0/RPMS/ftp-client-krb5-1.2.5-1.2mdk.i586.rpm b6bb6b48289cc350180e743373d8ea35 9.0/RPMS/ftp-server-krb5-1.2.5-1.2mdk.i586.rpm 95628f75c909f201c986c647b293b597 9.0/RPMS/krb5-devel-1.2.5-1.2mdk.i586.rpm 4b1ce4edcc5c73b567131a2e3f8633f5 9.0/RPMS/krb5-libs-1.2.5-1.2mdk.i586.rpm d80438ee2e192b45416a8f849e7047b2 9.0/RPMS/krb5-server-1.2.5-1.2mdk.i586.rpm a23ab952296f74b9dad7f7fc0404e5c0 9.0/RPMS/krb5-workstation-1.2.5-1.2mdk.i586.rpm fdc950553fa7f3fcc200d5e9661c8d9b 9.0/RPMS/telnet-client-krb5-1.2.5-1.2mdk.i586.rpm 97a4e7e29404a7f49fe9f46f3397178e 9.0/RPMS/telnet-server-krb5-1.2.5-1.2mdk.i586.rpm fd17b5fa3db51eeb35d7da87ea725ee1 9.0/SRPMS/krb5-1.2.5-1.2mdk.src.rpm
| References |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
http://www.kb.cert.org/vuls/id/875073
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-002-kadm4.txt
| Upgrade |
To upgrade automatically, use MandrivaUpdate.
| Verification |
Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :
rpm --checksig package.rpm
You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.
If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.