RHBA-2013:0319 - Bug Fix Advisory

Topic

Updated krb5 packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

Kerberos is a network authentication system which allows clients and servers to
authenticate to each other using symmetric encryption and a trusted third-party,
the Key Distribution Center (KDC).

The krb5 packages have been upgraded to upstream version 1.10.3, which provides
a number of bug fixes over the previous version, including better support of
cross-domain trust functionality in other packages. (BZ#823926)

This update fixes the following bugs:

• Older versions of the libsmbclient package incorrectly depended on the

krb5_locate_kdc() function, which is no longer supported. Consequently,
applications which used older versions of libsmbclient became incompatible after
the Kerberos library update. With this update, an explicit conflict with older
versions of libsmbclient has been added. As a result, an incompatible
combination cannot be installed. (BZ#771687)

• Previously, when the krb5-auth-dialog application was used and the prompter

was left hanging for a long period of time, a large clock skew was mistakenly
recorded. This clock drift was applied in the next kinit session. Consequently,
the klist function reported an incorrect expiration time. This bug has been
fixed, and the spurious time offset no longer occurs in the described scenario.
(BZ#773496)

• Previously, when a list of trusted roots of a PKINIT client included the KDC's

certificates, certain KDC implementations omitted such anchors from the list of
certificates in the signed data structure. Consequently, the client failed to
verify the KDC's signature on the signed data. With this update, a backported
fix has been included to allow the client to use its own copies of relevant
certificates. As a result, the verification no longer fails in the
aforementioned scenario. (BZ#834718)

• Prior to this update, attempts to use the kinit command with a keytab file

often failed when the keytab file did not contain the Advanced Encryption
Standard (AES) keys, but the client's libraries and the KDC both supported AES.
The strongest supported encryption type (AES) was chosen by default, even though
it was not present in keytab. Consequently, a mismatch error occurred. The bug
has been fixed, and keytabs containing any of the supported encryption types are
now correctly processed. (BZ#837855)

• Previously, the krb5 package did not handle the timeout variable properly. In

certain cases, the timeout variable became a negative number. Consequently, the
client entered a loop while checking for responses. With this update, the client
logic has been modified and the described error no longer occurs. (BZ#838548)

• Prior to this update, the passwd utility failed when used by an Identity

Management client. Consequently, an error occurred with the following message:

token manipulation error

The bug has been fixed, and the passwd utility now works with Identity
Management as expected. (BZ#839017)

• Due to a previous update to a locally-applied patch, files created by the

libkrb5 library were given correct SELinux labels. However, each flushing of the
replay cache caused the file context configuration to be reloaded to ensure that
the correct label is applied to the newly-created replacement replay cache file.
This resulted in large performance degradation in applications which accept
authentication and use replay caches. With this update, the context
configuration is only loaded when the context configuration file has been
modified and the configuration is now freed only when the library is unloaded or
the calling application exits, thus greatly lowering the impact of this problem.
(BZ#845125, BZ#846472)

All users of krb5 are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 771687 - ABI issue in MIT krb5 1.10 scheduled for RHEL 6.4
• BZ - 773496 - Prompter delay can cause spurious clock skew
• BZ - 823926 - Rebase krb5 to 1.10 for AD trust to work
• BZ - 834718 - backport RT#7183 to allow PKINIT to process signedData which omits the certificates list
• BZ - 837855 - Mismatch of enctypes between principal and princpal
• BZ - 845125 - Slow response when binding with GSSAPI to 389 Directory Server
• BZ - 846472 - Slow performance when using Kerberos
• BZ - 871524 - orphaned krb5kdc processes restarting IPA services

CVEs

(none)

References

(none)