Scientific Linux alert SL-krb5-20110705 (krb5-appl)

From:
    	     
 
Troy Dawson <dawson@fnal.gov> 
To:
    	     
 
"scientific-linux-errata@fnal.gov" <scientific-linux-errata@fnal.gov> 
Subject:
    	     
 
Security ERRATA Important: krb5-appl on SL6.x i386/x86_64 
Date:
    	     
 
Tue, 05 Jul 2011 16:26:44 -0500
Message-ID:
    	     
 
<4E138194.5070500@fnal.gov>

Synopsis:	Important: krb5-appl security update
Issue date:	2011-07-05
CVE Names:	CVE-2011-1526

The krb5-appl packages provide Kerberos-aware telnet, ftp, rcp, rsh, and
rlogin clients and servers. While these have been replaced by tools such 
as OpenSSH in most environments, they remain in use in others.

It was found that gssftp, a Kerberos-aware FTP server, did not properly
drop privileges. A remote FTP user could use this flaw to gain 
unauthorized read or write access to files that are owned by the root 
group. (CVE-2011-1526)

SL 6.x

       SRPMS:
krb5-appl-1.0.1-2.el6_1.1.src.rpm
       i386:
krb5-appl-clients-1.0.1-2.el6_1.1.i686.rpm
krb5-appl-servers-1.0.1-2.el6_1.1.i686.rpm
       x86_64:
krb5-appl-clients-1.0.1-2.el6_1.1.x86_64.rpm
krb5-appl-servers-1.0.1-2.el6_1.1.x86_64.rpm

- Scientific Linux Development Team