Fedora alert FEDORA-2009-2852 (krb5)
| From: | updates@fedoraproject.org | |
| To: | fedora-package-announce@redhat.com | |
| Subject: | [SECURITY] Fedora 10 Update: krb5-1.6.3-18.fc10 | |
| Date: | Tue, 07 Apr 2009 23:24:17 +0000 | |
| Message-ID: | <20090407232337.2428E10F86B@bastion2.fedora.phx.redhat.com> | |
| Archive‑link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-2852 2009-03-18 18:33:45 -------------------------------------------------------------------------------- Name : krb5 Product : Fedora 10 Version : 1.6.3 Release : 18.fc10 URL : http://web.mit.edu/kerberos/www/ Summary : The Kerberos network authentication system. Description : Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of cleartext passwords. -------------------------------------------------------------------------------- Update Information: This update incorporates patches to fix potential read overflow and NULL pointer dereferences in the implementation of the SPNEGO GSSAPI mechanism (CVE-2009-0844, CVE-2009-0845), attempts to free an uninitialized pointer during protocol parsing (CVE-2009-0846), and a bug in length validation during protocol parsing (CVE-2009-0847). -------------------------------------------------------------------------------- ChangeLog: * Tue Apr 7 2009 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-18 - add patches for read overflow and null pointer dereference in the implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845) - add patch for attempt to free uninitialized pointer in libkrb5 (CVE-2009-0846) - add patch to fix length validation bug in libkrb5 (CVE-2009-0847) * Tue Mar 17 2009 Nalin Dahyabhai <nalin@redhat.com> 1.6.3-17 - libgssapi_krb5: backport fix for some errors which can occur when we fail to set up the server half of a context (CVE-2009-0845) * Thu Sep 4 2008 Nalin Dahyabhai <nalin@redhat.com> - if we successfully change the user's password during an attempt to get initial credentials, but then fail to get initial creds from a non-master using the new password, retry against the master (#432334) -------------------------------------------------------------------------------- References: [ 1 ] Bug #490634 - CVE-2009-0845 krb5: Null pointer dereference in GSSAPI SPNEGO security mechanism https://bugzilla.redhat.com/show_bug.cgi?id=490634 [ 2 ] Bug #491033 - CVE-2009-0844 krb5: buffer over-read in SPNEGO GSS-API mechanism (MITKRB5-SA-2009-001) https://bugzilla.redhat.com/show_bug.cgi?id=491033 [ 3 ] Bug #491036 - CVE-2009-0846 krb5: ASN.1 decoder can free uninitialized pointer when decoding an invalid encoding (MITKRB5-SA-2009-002) https://bugzilla.redhat.com/show_bug.cgi?id=491036 [ 4 ] Bug #491034 - CVE-2009-0847 krb5: incorrect length check inside ASN.1 decoder (MITKRB5-SA-2009-001) https://bugzilla.redhat.com/show_bug.cgi?id=491034 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update krb5' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-ann...