RHBA-2015:1410 - Bug Fix Advisory

Topic

Updated krb5 packages that fix two bugs and add one enhancement are now
available for Red Hat Enterprise Linux 6.

Description

Kerberos is a networked authentication system that allows clients and servers to
authenticate to each other with the help of a trusted third party, the Kerberos
key distribution center.

This update fixes the following bugs:

• Prior to this update, if the Kerberos principal keys were expired, the

password change request did not take into account the FAST framework settings
for password change requests. Consequently, the pre-auth methods, which require
FAST, could not be used for user authentication. This update modifies krb5 to
correctly use FAST armor in the password change messages, and the pre-auth
methods can be used for user authentication. (BZ#1075656)

• Previously, after the user set up incremental propagation between a KDC master

and slave, an attempt to perform a full synchronization failed with an error
message. A patch has been applied to fix this problem, and full synchronization
no longer fails after the user sets up incremental propagation between a KDC
master and slave. (BZ#1154130)

In addition, this update adds the following enhancement:

• This update adds the LocalAuth plug-in API to krb5. SSSD can leverage

LocalAuth to allow seamless authentication of Active Directory (AD) users to Red
Hat Enterprise Linux Identity Management (IdM) clients. (BZ#1170272)

Users of krb5 are advised to upgrade to these updated packages, which fix these
bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1075656 - krb5 client ignores FAST settings for changepw requests
• BZ - 1170272 - [RFE] Add LocalAuth plugin API
• BZ - 1210704 - Remove stray include in krb5's localauth_plugin.h

CVEs

(none)

References

(none)