RHBA-2013:1222 - Bug Fix Advisory

Topic

Updated krb5 packages that fix two bugs are now available for Red Hat Enterprise
Linux 6..

Description

Kerberos is an authentication system which allows clients and services to
authenticate to each other with the help of a trusted third party, a Kerberos
KDC.

This update fixes the following bugs:

• In the simplest configuration, an organization establishes a single Kerberos

realm, in which all of its clients and servers trust the same KDC. Clients from
one realm can authenticate to services in another realm if their respective KDCs
are properly configured for cross-realm authentication. Cross-realm
authentication can also be performed transitively, allowing clients from one
realm to authenticate first to the KDC of an intermediate realm, possibly
continuing along a path containing multiple intermediate realms, and then
finally to a service in yet another realm. When a service accepts authentication
using GSSAPI, if the client is a member of a different realm, the server will
check the client's ticket for a list of the intermediate realms whose KDCs the
client contacted in order to obtain a ticket for the service. If the list
contains any entries which the service does not expect to be in that path, the
ticket is considered invalid and authentication is rejected. In certain
configurations, due to a bug introduced while adding support for the
"ignore_acceptor_hostname" option, this test failed unconditionally. This update
corrects the issue with the "ignore_acceptor_hostname" option, and failures no
longer occur in the described scenario. (BZ#1000313).

• When processing client requests transmitted to it using the flexible

authentication secure tunneling (FAST) facility, the KDC would lose track of the
type of the request that the client supplied, potentially causing it to fail to
include authorization data in the ticket it would later issue in response to the
request. In some environments, this would result in authorization to resources
being incorrectly denied. This update sets the msg_type option when decoding
FAST requests, and access control no longer fails in the described scenario.
(BZ#1002179).

Users of krb5 are advised to upgrade to these updated packages, which fix these
bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.4 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.4 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.4 i386
• Red Hat Gluster Storage Server for On-premise 2.1 x86_64
• Red Hat Storage for Public Cloud (via RHUI) 2.1 x86_64
• Red Hat Enterprise Linux Server - AUS 6.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1002179 - PAC is not recognized in krb5 1.10 KDC at TGS-REQ from krb5-1.11 client

CVEs

(none)

References

(none)