RHBA-2012:0057 - Bug Fix Advisory

Topic

An updated mod_auth_kerb package that fixes one bug is now available for Red Hat
Enterprise Linux 5.

Description

The mod_auth_kerb package provides a module for the Apache HTTP Server designed
to provide Kerberos authentication over HTTP. The module supports the Negotiate
authentication method, which performs full Kerberos authentication based on
ticket exchanges.

This update fixes the following bug:

• The mod_auth_kerb module did not use the Kerberos libraries in a thread-safe

way. Therefore, if mod_auth_kerb ran under a multi-threaded Apache HTTP Server,
authentication requests could terminate unexpectedly with a segmentation fault.
With this update, the thread-safety problem has been fixed, and thread crashes
no longer occur under these circumstances. (BZ#783228)

All users of mod_auth_kerb are advised to upgrade to this updated package, which
fixes this bug.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

CVEs

(none)

References

(none)