RHBA-2007:0238 - Bug Fix Advisory

Topic

Updated krb5 packages that fix several bugs are now available.

Description

Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords.

This update addresses the following issues:

• Several non-binary files in the krb5-devel package contain information

about the target platform for which the package was built. On multilib
systems, these files created file-level package conflicts which prevented
installation of more than one version of the package on a system.

• The krb5_parse_name() function is used to convert the string representation

of a Kerberos principal name into a krb5_principal structure. When the
string representation of a user's principal did not explicitly include a
realm name, krb5_parse_name() used the name of the system's default realm,
even if the calling application had previously used the
krb5_set_default_realm() function to override this value.

• If the krb5_get_init_creds_keytab() function failed to obtain initial

credentials using the default KDC, it attempted to contact the master KDC
for the realm. If it was unable to locate a master KDC, the error code
that it returned indicated that the KDC could not be located, rather than
the error that was reported by the KDC that it first contacted.

• After successfully authenticating a user and spawning a shell, ksu always

reported an error via its exit status, even if the shell exited without
indicating an error had occurred.

• The kshd daemon erroneously sent a SIGTERM signal to members of its

child's process group when reporting that its child had exited.

All users of Kerberos V5 should upgrade to these updated packages, which
contain backported patches to correct these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 179062 - [PATCH] krb5_parse_name() doesn't track changes to default realm
• BZ - 180671 - failure to find a master kdc masks an error returned from a non-master
• BZ - 202191 - multilib -devel conflicts for krb5
• BZ - 209512 - [RHEL4] krb5-workstation : ksu fails on exit
• BZ - 219137 - kshd stops processes if these are in the background.

CVEs

(none)

References

(none)