RHBA-2013:0078 - Bug Fix Advisory

Topic

Updated mod_auth_kerb packages that fix two bugs and add one enhancement are now
available for Red Hat Enterprise Linux 5.

Description

The mod_auth_kerb package provides a module for the Apache HTTP Server designed
to provide Kerberos authentication over HTTP. The module supports the Negotiate
authentication method, which performs full Kerberos authentication based on
ticket exchanges.

These updated mod_auth_kerb packages provide fixes for the following bugs:

• Prior to this update, the mod_auth_kerb source RPM could not be built by a

non-root user. This was because the httpd-devel package places the apxs utility,
which is needed to build the mod_auth_kerb package, into the /usr/sbin
directory. This directory is not specified in the PATH variable for non-root
users. With this update, the apxs utility is defined as being placed in the
/usr/bin directory in the "mod_auth_kerb.spec" file, and the mod_auth_kerb SRPM
can now be successfully built by non-root users. (BZ#456662)

• The "mod_auth_kerb" module did not use the Kerberos libraries in a thread-safe

way. Therefore, if mod_auth_kerb ran under a multi-threaded Apache HTTP Server,
authentication requests could terminate unexpectedly with a segmentation fault.
With this update, the thread-safety problem has been fixed, and crashes no
longer occur under these circumstances. (BZ#734098)

In addition, these updated mod_auth_kerb packages provide the following
enhancement:

• The "KrbLocalUserMapping" Apache directive has been added to allow Kerberos

principal names to be mapped to system user names. (BZ#446670)

Users are advised to upgrade to these updated mod_auth_kerb packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 446670 - [RFE] Include apache directive 'KrbLocalUserMapping' in 'mod_auth_kerb'
• BZ - 456662 - mod_auth_kerb does not build from SRPM
• BZ - 734098 - mod_auth_kerb threading problems

CVEs

(none)

References

(none)