Updated krb5 packages that fix one security issue are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) associated with each description below.
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).
- A NULL pointer dereference flaw was found in the way the MIT Kerberos KDC processed certain TGS (Ticket-granting Server) requests. A remote, authenticated attacker could use this flaw to crash the KDC via a specially-crafted TGS request.
Red Hat would like to thank the MIT Kerberos project for reporting this issue.
All krb5 users should upgrade to these updated packages, which contain a backported patch to correct this issue. After installing the updated packages, the krb5kdc daemon will be restarted automatically.
Updated krb5 packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
The Kerberos authentication system allows clients and servers to authenticate to each other using symmetric encryption and the help of a trusted third party, the KDC. This update fixes the following bugs:
- Kerberos version 1.8 and later defaults to disabling support for older encryption types which are no longer believed to be sufficiently strong. When upgrading from older versions of Red Hat Enterprise Linux, a number of services which run at the key distribution center (KDC) need to have their keys reset to include keys for newer encryption types. This update adds a spot-check to the KDC init script which assist in diagnosing this condition.
- BZ#701446, BZ#746341
- Previously, a client could fail to connect to a KDC if a sufficiently large number of descriptors was already in use. This update modifies the Kerberos libraries to switch to using poll() instead of select(), which does not suffer from this limitation.
- BZ#713252, BZ#729068
- Previously, the kadmin client could fail to establish a connection with certain older versions of the kadmin daemon. In these situations, the server often logged a diagnostic noting that the client had supplied it with incorrect channel bindings. This update modifies the client to allow it to once again contact those versions of kadmind.
- Previously, a client failed to obtain credentials for authentication from KDCs that rejected requests specifying unrecognized options and that also did not support the canonicalize option. With this update, obtaining credentials also works with these KDCs.
- Previously, locally-applied patches, which attempt to ensure that any files created by the Kerberos libraries are given and keep the correct SELinux file labels, did not correctly ensure that replay cache files kept their labels. This update corrects the patch to cover this case.
- Previously, the Kerberos client libraries could inadvertently trigger an address-to-name lookup inside of the resolver libraries when attempting to derive a principal name from a combination of a service name and a host name, even if the user disabled them using the "rdns" setting in the krb5.conf file. This update modifies the client library to prevent it from triggering these lookups.
- Previously, the kadmind init script could erroneously refuse to start the kadmind server on a KDC, if the realm database was moved to a non-default location, or a non-default kdb backend was in use. This update removes the logic from the init script which caused it to do so.
- Previously, the krb5-debuginfo package excluded several source files used to build the package. This update ensures that the affected files are still included.
- Previously, obtaining the Kerberos credentials for services could fail fail if the target server was in another trusted realm than the client. This update modifies krb5-libs so that the client obtains the credentials as expected.
All Kerberos users are advised to upgrade to these updated packages, which fix these bugs.