RHBA-2008:0714 - Bug Fix Advisory

Topic

Updated krb5 packages that fix several bugs are now available.

Description

Kerberos is a network authentication system, which allows clients and
servers to authenticate to each other through the use of symmetric
encryption and a trusted third party: the Key Distribution Center (KDC).

These updated packages fix the following bugs:

• the krb5 init scripts returned certain error codes that did not comply

with guidelines for various causes of failure. In these updated packages,
the init scripts have been updated to more closely conform to
distribution-wide guidelines.

• when a calling application supplied a zero-length password, and a

callback function to the krb5_get_init_creds_password() function, libkrb5
provided that callback function with a zero-length buffer in which to place
answers to any questions being asked. This may have denied users SSH access
if sshd was running with the "PermitEmptyPasswords yes" option configured
in "/etc/ssh/sshd_config". These updated packages included a backported fix
to resolve this issue.

• when replying to an AS request, the KDC incorrectly reported the client's

account expiration time, instead of the client's password expiration time,
frequently causing the client application to display an erroneous warning
to the user.

• due to a packaging error, RPM verification failed. RPM incorrectly

flagged, as a possible problem, that the contents of the "/etc/krb5.conf"
configuration file had changed, despite such changes being both expected
and normal.

Users of krb5 are advised to upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 242501 - Wrong init script
• BZ - 244645 - Problem for ssh for kerberos users with PermitEmptyPasswords yes
• BZ - 327521 - Rpm Verify Fails - krb5.conf needs %verify(not md5 size mtime) in %config
• BZ - 442772 - ftp case directive botches mget when mixed case filenames exit

CVEs

(none)

References

(none)