RHBA-2011:1016 - Bug Fix Advisory

Topic

An updated pam_krb5 package that fixes various bugs is now available for Red Hat
Enterprise Linux 5.

Description

The pam_krb5 package allows applications which use the Pluggable Authentication
Modules (PAM) framework to perform password-based authentication using Kerberos
5.

This updated pam_krb5 package includes fixes for the following bugs:

• Previously, multiple authentication attempts may have led to a memory leak

when the pam_krb5 module was unloaded. This was caused when the calling
application cleaned up the context it used when interacting with the libpam.
This has been fixed by preventing the module from being unloaded. (BZ#643962)

• An attempt to set a new Kerberos password using the "passwd" command failed

due to a bug which was triggered when the smart card authentication method was
enabled and the card was plugged in. This problem has been fixed and users are
now able to change the Kerberos password. (BZ#713967)

All users of pam_krb5 are advised to upgrade to this updated package, which
resolves these issues.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat
Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 643962 - [NetApp 5.7 bug] Memory leak on PAM for Active Directory users
• BZ - 713967 - Smart card login with Kerberos credential: passwd command does not change the kerberos password.

CVEs

(none)

References

(none)