RHBA-2011:1707 - Bug Fix Advisory

Topic

Updated krb5 packages that fix multiple bugs are now available for Red Hat
Enterprise Linux 6.

Description

The Kerberos authentication system allows clients and servers to authenticate to
each other using symmetric encryption and the help of a trusted third party, the
KDC. This update fixes the following bugs:

• Kerberos version 1.8 and later defaults to disabling support for older

encryption types which are no longer believed to be sufficiently strong. When
upgrading from older versions of Red Hat Enterprise Linux, a number of services
which run at the key distribution center (KDC) need to have their keys reset to
include keys for newer encryption types. This update adds a spot-check to the
KDC init script which assist in diagnosing this condition. (BZ#651466)

• Previously, a client could fail to connect to a KDC if a sufficiently large

number of descriptors was already in use. This update modifies the Kerberos
libraries to switch to using poll() instead of select(), which does not suffer
from this limitation. (BZ#701446,BZ#746341)

• Previously, the kadmin client could fail to establish a connection with

certain older versions of the kadmin daemon. In these situations, the server
often logged a diagnostic noting that the client had supplied it with incorrect
channel bindings. This update modifies the client to allow it to once again
contact those versions of kadmind. (BZ#713252,BZ#729068)

• Previously, a client failed to obtain credentials for authentication from KDCs

that rejected requests specifying unrecognized options and that also did not
support the canonicalize option. With this update, obtaining credentials also
works with these KDCs. (BZ#713518)

• Previously, locally-applied patches, which attempt to ensure that any files

created by the Kerberos libraries are given and keep the correct SELinux file
labels, did not correctly ensure that replay cache files kept their labels. This
update corrects the patch to cover this case. (BZ#714217)

• Previously, the Kerberos client libraries could inadvertently trigger an

address-to-name lookup inside of the resolver libraries when attempting to
derive a principal name from a combination of a service name and a host name,
even if the user disabled them using the "rdns" setting in the krb5.conf file.
This update modifies the client library to prevent it from triggering these
lookups. (BZ#717378)

• Previously, the kadmind init script could erroneously refuse to start the

kadmind server on a KDC, if the realm database was moved to a non-default
location, or a non-default kdb backend was in use. This update removes the logic
from the init script which caused it to do so. (BZ#724033)

• Previously, the krb5-debuginfo package excluded several source files used to

build the package. This update ensures that the affected files are still
included. (BZ#729044)

• Previously, obtaining the Kerberos credentials for services could fail fail

if the target server was in another trusted realm than the client. This update
modifies krb5-libs so that the client obtains the credentials as expected.
(BZ#734341)

All Kerberos users are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 651466 - Unable to run kadmin from RHEL6 machines
• BZ - 701446 - Fix libkrb5 to work when > 1024 file descriptors are in use
• BZ - 711032 - avoid a build failure without downstream patches and introduce a way to exclude test-suite
• BZ - 713252 - kadmin on RHEL6.1 fails due to incorrect gssapi channel bindings
• BZ - 713518 - Canonicalize fallback only works for different realm (MITKRB RT #6917)
• BZ - 714217 - application linked to krb5-libs creates /var/tmp/host_0 with wrong selinux context
• BZ - 717378 - Backport getaddrinfo workaround
• BZ - 723995 - Library needs partial RELRO support added
• BZ - 724033 - kadmin fails to start when using a custom DAL driver
• BZ - 729044 - Debuginfo package issues in krb5
• BZ - 729068 - kadmin incompatible with kdc
• BZ - 734172 - net ads join segfault
• BZ - 746341 - [abrt] evolution-3.1.91-2.fc16: __GI_raise, cm_get_ssflags, krb5int_sendto, krb5_sendto_kdc, krb5_tkt_creds_get

CVEs

(none)

References

(none)