From bugzilla@REDHAT.COM Wed Mar 28 20:14:01 2001 From: bugzilla@REDHAT.COM To: BUGTRAQ@SECURITYFOCUS.COM Date: Tue, 27 Mar 2001 15:24:00 -0500 Subject: [BUGTRAQ] [RHSA-2001:025-14] Updated Kerberos 5 and pam_krb5 packages available [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Updated Kerberos 5 and pam_krb5 packages available Advisory ID: RHSA-2001:025-14 Issue date: 2001-03-08 Updated on: 2001-03-27 Product: Red Hat Linux Keywords: kerberos libkrb4 race Cross references: Obsoletes: RHSA-2000:025 --------------------------------------------------------------------- 1. Topic: Updated Kerberos 5 packages are now available for Red Hat Linux 6 and 7. These packages fix a vulnerability in the handling of Kerberos IV ticket files. Updated pam_krb5 packages are now available for Red Hat Linux 7. 2. Relevant releases/architectures: Red Hat Linux 6.2 - alpha, i386, sparc Red Hat Linux 7.0 - alpha, i386 3. Problem description: A race condition exists in libkrb4 which would allow a malicious user to cause kerberized login services to overwrite the contents of any file on the system. The destroyed file would contain the kerberos credentials of an unsuspecting user who had attempted to log in using the kerberized login service being exploited. Additional precautions taken in Kerberos 5 1.2.2 will cause pam_krb5 to fail when it attempts to create Kerberos IV ticket files on behalf of users. An update for the pam_krb5 package is also available which corrects this. 4. Solution: To update all RPMs for your particular architecture, run: rpm -Fvh where is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directly *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 11588 - RH6.2 krb5 errata breaks credential forwarding over rsh 14301 - workstation 1.1.1-21 ftp core dumps on put nfs* when symlink present. 6. RPMs required: Red Hat Linux 6.2: SRPMS: ftp://updates.redhat.com/6.2/SRPMS/krb5-1.1.1-26.src.rpm alpha: ftp://updates.redhat.com/6.2/alpha/krb5-configs-1.1.1-26.alpha.rpm ftp://updates.redhat.com/6.2/alpha/krb5-devel-1.1.1-26.alpha.rpm ftp://updates.redhat.com/6.2/alpha/krb5-libs-1.1.1-26.alpha.rpm ftp://updates.redhat.com/6.2/alpha/krb5-server-1.1.1-26.alpha.rpm ftp://updates.redhat.com/6.2/alpha/krb5-workstation-1.1.1-26.alpha.rpm i386: ftp://updates.redhat.com/6.2/i386/krb5-configs-1.1.1-26.i386.rpm ftp://updates.redhat.com/6.2/i386/krb5-devel-1.1.1-26.i386.rpm ftp://updates.redhat.com/6.2/i386/krb5-libs-1.1.1-26.i386.rpm ftp://updates.redhat.com/6.2/i386/krb5-server-1.1.1-26.i386.rpm ftp://updates.redhat.com/6.2/i386/krb5-workstation-1.1.1-26.i386.rpm sparc: ftp://updates.redhat.com/6.2/sparc/krb5-configs-1.1.1-26.sparc.rpm ftp://updates.redhat.com/6.2/sparc/krb5-devel-1.1.1-26.sparc.rpm ftp://updates.redhat.com/6.2/sparc/krb5-libs-1.1.1-26.sparc.rpm ftp://updates.redhat.com/6.2/sparc/krb5-server-1.1.1-26.sparc.rpm ftp://updates.redhat.com/6.2/sparc/krb5-workstation-1.1.1-26.sparc.rpm Red Hat Linux 7.0: SRPMS: ftp://updates.redhat.com/7.0/SRPMS/krb5-1.2.2-3.src.rpm ftp://updates.redhat.com/7.0/SRPMS/pam_krb5-1.29-1.src.rpm alpha: ftp://updates.redhat.com/7.0/alpha/krb5-devel-1.2.2-3.alpha.rpm ftp://updates.redhat.com/7.0/alpha/krb5-libs-1.2.2-3.alpha.rpm ftp://updates.redhat.com/7.0/alpha/krb5-server-1.2.2-3.alpha.rpm ftp://updates.redhat.com/7.0/alpha/krb5-workstation-1.2.2-3.alpha.rpm ftp://updates.redhat.com/7.0/alpha/pam_krb5-1.29-1.alpha.rpm i386: ftp://updates.redhat.com/7.0/i386/krb5-devel-1.2.2-3.i386.rpm ftp://updates.redhat.com/7.0/i386/krb5-libs-1.2.2-3.i386.rpm ftp://updates.redhat.com/7.0/i386/krb5-server-1.2.2-3.i386.rpm ftp://updates.redhat.com/7.0/i386/krb5-workstation-1.2.2-3.i386.rpm ftp://updates.redhat.com/7.0/i386/pam_krb5-1.29-1.i386.rpm 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 7041be9b57bb7249574a5a246066ae61 6.2/SRPMS/krb5-1.1.1-26.src.rpm e57ce788eca9711d182552b0350905d8 6.2/alpha/krb5-configs-1.1.1-26.alpha.rpm f36bdc4f5835f1e0217dfd700837cdf9 6.2/alpha/krb5-devel-1.1.1-26.alpha.rpm 22dd9ec7c70baea4be95b83fe3cbb2ce 6.2/alpha/krb5-libs-1.1.1-26.alpha.rpm 224c44e25f70dbc54c5a6d648e4c6313 6.2/alpha/krb5-server-1.1.1-26.alpha.rpm b5ddbc92d431a915446f9d67005971d6 6.2/alpha/krb5-workstation-1.1.1-26.alpha.rpm 545e22aaa62be18e9fbf563cc598d76a 6.2/i386/krb5-configs-1.1.1-26.i386.rpm 92428079be93de3fbeb3978fc497ced9 6.2/i386/krb5-devel-1.1.1-26.i386.rpm c7e015d80d88067e78586b146ec37c9e 6.2/i386/krb5-libs-1.1.1-26.i386.rpm 7d53d769b76e65ba39a7811ccb25e274 6.2/i386/krb5-server-1.1.1-26.i386.rpm cef0175a7b3ef6ef94cb3e04b6a86e67 6.2/i386/krb5-workstation-1.1.1-26.i386.rpm 1e06847c54890ed7bcb282f2fa4fab19 6.2/sparc/krb5-configs-1.1.1-26.sparc.rpm 5da36dc1c30528be46a30fb759f5163a 6.2/sparc/krb5-devel-1.1.1-26.sparc.rpm b5999a74da573b493a4080fa37858943 6.2/sparc/krb5-libs-1.1.1-26.sparc.rpm a1b6fbe0c70f481aa95aee59f53d7081 6.2/sparc/krb5-server-1.1.1-26.sparc.rpm 4d98e8df011616e0869bdfcca9c0442f 6.2/sparc/krb5-workstation-1.1.1-26.sparc.rpm c4da9f2ac64d7f59c40fab1a3c3586ce 7.0/SRPMS/krb5-1.2.2-3.src.rpm f22030ebe5580c7bf0d70f43bbbb4a67 7.0/SRPMS/pam_krb5-1.29-1.src.rpm f692e70599181623d7c709b4eeea949b 7.0/alpha/krb5-devel-1.2.2-3.alpha.rpm a1fa2ae040c8cc7dc26acdb6bc05a494 7.0/alpha/krb5-libs-1.2.2-3.alpha.rpm 711e54bf1f4d6af2507fc7f0640cfdbc 7.0/alpha/krb5-server-1.2.2-3.alpha.rpm 1b1cc01a728807494640d178db7f8b66 7.0/alpha/krb5-workstation-1.2.2-3.alpha.rpm 78374857b86d974ef373165c94dca18f 7.0/alpha/pam_krb5-1.29-1.alpha.rpm e973b9b830d31f0bdd27b3cf703486fd 7.0/i386/krb5-devel-1.2.2-3.i386.rpm 56f6429dc0e346ebdc3997c1a84d4a34 7.0/i386/krb5-libs-1.2.2-3.i386.rpm 1e88d30acf76d26a2a80affd8f3cf444 7.0/i386/krb5-server-1.2.2-3.i386.rpm 9605d6cb0049f7b68a94d44155dd470e 7.0/i386/krb5-workstation-1.2.2-3.i386.rpm fbf60c1b273d86c0388be4b1921fbe37 7.0/i386/pam_krb5-1.29-1.i386.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 8. References: http://web.mit.edu/kerberos/www/advisories/krb4tkt.txt Copyright(c) 2000, 2001 Red Hat, Inc.