From bugzilla@redhat.com Thu May 17 00:13:55 2001 From: bugzilla@redhat.com To: redhat-watch-list@redhat.com Cc: bugtraq@securityfocus.com, linux-security@redhat.com, security@redhat.com Date: Wed, 16 May 2001 21:35 -0400 Subject: [RHSA-2001:060-04] Updated Kerberos 5 packages available [The following text is in the "iso-8859-1" character set] [Your display is set for the "US-ASCII" character set] [Some characters may be displayed incorrectly] --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Updated Kerberos 5 packages available Advisory ID: RHSA-2001:060-04 Issue date: 2001-04-26 Updated on: 2001-05-16 Product: Red Hat Linux Keywords: kerberos ftpd glob Cross references: Obsoletes: RHSA-2001:025 --------------------------------------------------------------------- 1. Topic: Updated Kerberos 5 packages are now available for Red Hat Linux 6.2, 7, and 7.1. These updates close a potential vulnerability present in the gssapi-aware ftpd included in the krb5-workstation package. 2. Relevant releases/architectures: Red Hat Linux 6.2 - alpha, i386, sparc Red Hat Linux 7.0 - alpha, i386 Red Hat Linux 7.1 - i386 3. Problem description: By use of a carefully-crafted authentication request, a malicious client could exploit a vulnerability made possible by a missing bounds check. A malicious client could also overflow the buffer space used by the server for performing globbing operations. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 34372 - krb5-server-1.2.2-4.alpha.rpm i386 compatibility 35978 - gssftp can be segfaulted remotely, possibly exploitable 6. RPMs required: Red Hat Linux 6.2: SRPMS: ftp://updates.redhat.com/6.2/en/os/SRPMS/krb5-1.1.1-27.src.rpm alpha: ftp://updates.redhat.com/6.2/en/os/alpha/krb5-configs-1.1.1-27.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/krb5-devel-1.1.1-27.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/krb5-libs-1.1.1-27.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/krb5-server-1.1.1-27.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/krb5-workstation-1.1.1-27.alpha.rpm i386: ftp://updates.redhat.com/6.2/en/os/i386/krb5-configs-1.1.1-27.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/krb5-devel-1.1.1-27.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/krb5-libs-1.1.1-27.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/krb5-server-1.1.1-27.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/krb5-workstation-1.1.1-27.i386.rpm sparc: ftp://updates.redhat.com/6.2/en/os/sparc/krb5-configs-1.1.1-27.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/krb5-devel-1.1.1-27.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/krb5-libs-1.1.1-27.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/krb5-server-1.1.1-27.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/krb5-workstation-1.1.1-27.sparc.rpm Red Hat Linux 7.0: SRPMS: ftp://updates.redhat.com/7.0/en/os/SRPMS/krb5-1.2.2-5.src.rpm alpha: ftp://updates.redhat.com/7.0/en/os/alpha/krb5-devel-1.2.2-5.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/krb5-libs-1.2.2-5.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/krb5-server-1.2.2-5.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/krb5-workstation-1.2.2-5.alpha.rpm i386: ftp://updates.redhat.com/7.0/en/os/i386/krb5-devel-1.2.2-5.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/krb5-libs-1.2.2-5.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/krb5-server-1.2.2-5.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/krb5-workstation-1.2.2-5.i386.rpm Red Hat Linux 7.1: SRPMS: ftp://updates.redhat.com/7.1/en/os/SRPMS/krb5-1.2.2-5.src.rpm i386: ftp://updates.redhat.com/7.1/en/os/i386/krb5-devel-1.2.2-5.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/krb5-libs-1.2.2-5.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/krb5-server-1.2.2-5.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/krb5-workstation-1.2.2-5.i386.rpm 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 6ce2742e193047a719701d83b7178c59 6.2/en/os/SRPMS/krb5-1.1.1-27.src.rpm f21e8e6beb5a91ebca4b00af0d1daf10 6.2/en/os/alpha/krb5-configs-1.1.1-27.alpha.rpm 1b2fd96e0f9d584b8a7ab16ff8d37b7b 6.2/en/os/alpha/krb5-devel-1.1.1-27.alpha.rpm ab736f348078aee145f243f74a964be7 6.2/en/os/alpha/krb5-libs-1.1.1-27.alpha.rpm c5fa26e257ad18d1feb917f78d4af0ad 6.2/en/os/alpha/krb5-server-1.1.1-27.alpha.rpm 01370ea541a8e521d1729649c52dddb3 6.2/en/os/alpha/krb5-workstation-1.1.1-27.alpha.rpm 65b68eaf07eb52ac3bf2c6a488843589 6.2/en/os/i386/krb5-configs-1.1.1-27.i386.rpm c50eaabded279e17ca281e80a21a0b0e 6.2/en/os/i386/krb5-devel-1.1.1-27.i386.rpm 49696baafd5cdcd404992bb334067974 6.2/en/os/i386/krb5-libs-1.1.1-27.i386.rpm e8421683d01ac72ddc7142a6fee34889 6.2/en/os/i386/krb5-server-1.1.1-27.i386.rpm 21b8178fa4ef08ed1863d14b6569d858 6.2/en/os/i386/krb5-workstation-1.1.1-27.i386.rpm 7914bb3f4a9eafbf056bff8b2da51654 6.2/en/os/sparc/krb5-configs-1.1.1-27.sparc.rpm d11e49281aeb3b1dee8065b10fbaf2c1 6.2/en/os/sparc/krb5-devel-1.1.1-27.sparc.rpm d03ce70b4a812159c7fcc1a805986484 6.2/en/os/sparc/krb5-libs-1.1.1-27.sparc.rpm b4bcf1b7499e606993b64b4188eb7a39 6.2/en/os/sparc/krb5-server-1.1.1-27.sparc.rpm b31a053948b7e02ab3ffa1d6d0a7bd36 6.2/en/os/sparc/krb5-workstation-1.1.1-27.sparc.rpm a304c1e0aafb594f6831795715ed854a 7.0/en/os/SRPMS/krb5-1.2.2-5.src.rpm 2310d383bc594c3487b479ed016bf017 7.0/en/os/alpha/krb5-devel-1.2.2-5.alpha.rpm dd8d77584d1d5b8c4e8f2d4bd9e0a48b 7.0/en/os/alpha/krb5-libs-1.2.2-5.alpha.rpm 970afd1e1a4719d69bf4017f854382b9 7.0/en/os/alpha/krb5-server-1.2.2-5.alpha.rpm 51fa47eb5fcb8ef62f2eea75df420034 7.0/en/os/alpha/krb5-workstation-1.2.2-5.alpha.rpm d0be51614bd35fd9b19728f56d0888ed 7.0/en/os/i386/krb5-devel-1.2.2-5.i386.rpm e5e0ba52db8502b4220065fa272d9141 7.0/en/os/i386/krb5-libs-1.2.2-5.i386.rpm 65663059a046813679c1e25a7e214cdd 7.0/en/os/i386/krb5-server-1.2.2-5.i386.rpm 8a3d78d021fbf4ea434989da1a5370ca 7.0/en/os/i386/krb5-workstation-1.2.2-5.i386.rpm a304c1e0aafb594f6831795715ed854a 7.1/en/os/SRPMS/krb5-1.2.2-5.src.rpm d0be51614bd35fd9b19728f56d0888ed 7.1/en/os/i386/krb5-devel-1.2.2-5.i386.rpm e5e0ba52db8502b4220065fa272d9141 7.1/en/os/i386/krb5-libs-1.2.2-5.i386.rpm 65663059a046813679c1e25a7e214cdd 7.1/en/os/i386/krb5-server-1.2.2-5.i386.rpm 8a3d78d021fbf4ea434989da1a5370ca 7.1/en/os/i386/krb5-workstation-1.2.2-5.i386.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 8. References: http://web.mit.edu/kerberos/www/advisories/ftpbuf.txt Copyright(c) 2000, 2001 Red Hat, Inc.