RHBA-2011:1704 - Bug Fix Advisory

Topic

An updated pam_krb5 package that fixes various bugs is now available for Red Hat
Enterprise Linux 6.

Description

The pam_krb5 package allows PAM-aware applications to check user passwords with
the help of a Kerberos KDC.

This updated pam_krb5 package includes fixes for the following bugs:

• When a client logged into a remote host using SSH with GSSAPI authentication,

configured to re-delegate credentials when the client obtains fresh credentials,
pam_krb5 created a new credential cache on the remote host in addition to the
cache created by SSH. Consequently, the credential cache that pam_krb5 had
created for the user's session would not be updated when they were renewed on
the client. This update prevents pam_krb5 from creating its own cache in the
scenario described, so the credential delegation mechanism is not interfered
with. (BZ#690832)

• Prior to this update, when a client attempted to perform a password change

after using a non-password-based pre-authentication mechanism (such as a Smart
Card), the pam_krb5 module would unnecessarily prompt for the user's PIN
(twice). This update corrects this bug. (BZ#700520)

• When a client, using SSH, logged into a remote host using the

PasswordAuthentication mechanism, two credential caches would be created for the
user on the remote host, but only one of them would be removed when the user
logged out. This update no longer creates the second, redundant cache.
(BZ#720609, BZ#722489, BZ#733803)

All users of pam_krb5 are advised to upgrade to this updated package, which
fixes these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 690832 - pam_krb5 breaks OpenSSH's recursive credential renewal
• BZ - 700520 - SSO: Smart card pin is requested twice for a 'passwd' command.
• BZ - 708507 - fails to build without downstream patches
• BZ - 733803 - pam_krb5 leaks ccache files when loging in through ssh

CVEs

(none)

References

(none)