Synopsis

krb5 security update

Type/Severity

Security Advisory: Important

Topic

Updated krb5 packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

Kerberos is a networked authentication system that uses a trusted third
party (a KDC) to authenticate clients and servers to each other.

A double-free flaw was found in the krb5_recvauth() routine which may be
triggered by a remote unauthenticated attacker. Red Hat Enterprise Linux 4
contains checks within glibc that detect double-free flaws. Therefore, on
Red Hat Enterprise Linux 4 successful exploitation of this issue can only
lead to a denial of service (KDC crash). The Common Vulnerabilities and
Exposures project assigned the name CAN-2005-1689 to this issue.

Daniel Wachdorf discovered a single byte heap overflow in the
krb5_unparse_name() function, part of krb5-libs. Sucessful exploitation of
this flaw would lead to a denial of service (crash). To trigger this flaw
an attacker would need to have control of a kerberos realm that shares a
cross-realm key with the target, making exploitation of this flaw unlikely.
(CAN-2005-1175).

Daniel Wachdorf also discovered that in error conditions that may occur in
response to correctly-formatted client requests, the Kerberos 5 KDC may
attempt to free uninitialized memory. This could allow a remote attacker
to cause a denial of service (KDC crash) (CAN-2005-1174).

Gaël Delalleau discovered an information disclosure issue in the way
some telnet clients handle messages from a server. An attacker could
construct a malicious telnet server that collects information from the
environment of any victim who connects to it using the Kerberos-aware
telnet client (CAN-2005-0488).

The rcp protocol allows a server to instruct a client to write to arbitrary
files outside of the current directory. This could potentially cause a
security issue if a user uses the Kerberos-aware rcp to copy files from a
malicious server (CAN-2004-0175).

All users of krb5 should update to these erratum packages, which contain
backported patches to correct these issues. Red Hat would like to thank
the MIT Kerberos Development Team for their responsible disclosure of these
issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 157103 - CAN-2005-1174 krb5 buffer overflow, heap corruption in KDC (CAN-2005-1175)
• BZ - 159304 - CAN-2005-0488 telnet Information Disclosure Vulnerability
• BZ - 159756 - CAN-2005-1689 double-free in krb5_recvauth
• BZ - 161471 - krb5 krb5_principal_compare NULL pointer crash
• BZ - 161611 - CAN-2004-0175 malicious rsh server can cause rcp to write to arbitrary files

CVEs

• CVE-2004-0175
• CVE-2005-1174
• CVE-2005-1175
• CVE-2005-1689

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
krb5-1.3.4-17.src.rpm	SHA-256: a2c5f1e4f590947e63f9c069854205915a48ba699f6ad4bde00e3ff0056debd3
x86_64
krb5-devel-1.3.4-17.x86_64.rpm	SHA-256: 00ccc0eb4192d56896297258715fa723b2adc2f0531830b218f392beafaf75ab
krb5-devel-1.3.4-17.x86_64.rpm	SHA-256: 00ccc0eb4192d56896297258715fa723b2adc2f0531830b218f392beafaf75ab
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.x86_64.rpm	SHA-256: 2cfb11a5993a05eae0ddded132dee8aba812405037ae3e0e4e619ac5ac9fd2ad
krb5-libs-1.3.4-17.x86_64.rpm	SHA-256: 2cfb11a5993a05eae0ddded132dee8aba812405037ae3e0e4e619ac5ac9fd2ad
krb5-server-1.3.4-17.x86_64.rpm	SHA-256: c63bea758ce3b5f80638a8a9fbdf541992e42bfceda949f1e3e0abcd464aaac1
krb5-server-1.3.4-17.x86_64.rpm	SHA-256: c63bea758ce3b5f80638a8a9fbdf541992e42bfceda949f1e3e0abcd464aaac1
krb5-workstation-1.3.4-17.x86_64.rpm	SHA-256: 3480f951e0adf05041382b99a3f9a62d64321a6b9dde19d24db9667b014bea3f
krb5-workstation-1.3.4-17.x86_64.rpm	SHA-256: 3480f951e0adf05041382b99a3f9a62d64321a6b9dde19d24db9667b014bea3f
ia64
krb5-devel-1.3.4-17.ia64.rpm	SHA-256: 6ec79564eb81f23aa670dda2f8a08476c398acda536284fd3266e10e2defdd7f
krb5-devel-1.3.4-17.ia64.rpm	SHA-256: 6ec79564eb81f23aa670dda2f8a08476c398acda536284fd3266e10e2defdd7f
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.ia64.rpm	SHA-256: c94367c97e53396c7c8e61445678db833cbb0e573af01cc7f68c62524960971e
krb5-libs-1.3.4-17.ia64.rpm	SHA-256: c94367c97e53396c7c8e61445678db833cbb0e573af01cc7f68c62524960971e
krb5-server-1.3.4-17.ia64.rpm	SHA-256: a4b477aeb3674fc17a7594d0e954d5649bfe09312d0e2d2e7011872b7ad57497
krb5-server-1.3.4-17.ia64.rpm	SHA-256: a4b477aeb3674fc17a7594d0e954d5649bfe09312d0e2d2e7011872b7ad57497
krb5-workstation-1.3.4-17.ia64.rpm	SHA-256: 50ce3bb1051d72a0c87fc62bdf42bf05339511ae655aed2323db755c25dfa310
krb5-workstation-1.3.4-17.ia64.rpm	SHA-256: 50ce3bb1051d72a0c87fc62bdf42bf05339511ae655aed2323db755c25dfa310
i386
krb5-devel-1.3.4-17.i386.rpm	SHA-256: 19e7e6eb26916c7e817f12fee2293bb6be12bd74e202445b292baa0e354f00f9
krb5-devel-1.3.4-17.i386.rpm	SHA-256: 19e7e6eb26916c7e817f12fee2293bb6be12bd74e202445b292baa0e354f00f9
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-server-1.3.4-17.i386.rpm	SHA-256: 86da9ab774e9e8bed06f8ebdfe9e5379c64aa30678ab63339d7abb926c59aa86
krb5-server-1.3.4-17.i386.rpm	SHA-256: 86da9ab774e9e8bed06f8ebdfe9e5379c64aa30678ab63339d7abb926c59aa86
krb5-workstation-1.3.4-17.i386.rpm	SHA-256: 113f6ecee0f423c64e7828802cd2e66358c3358f576ad6d6362b46c618000488
krb5-workstation-1.3.4-17.i386.rpm	SHA-256: 113f6ecee0f423c64e7828802cd2e66358c3358f576ad6d6362b46c618000488

Red Hat Enterprise Linux Workstation 4

SRPM
krb5-1.3.4-17.src.rpm	SHA-256: a2c5f1e4f590947e63f9c069854205915a48ba699f6ad4bde00e3ff0056debd3
x86_64
krb5-devel-1.3.4-17.x86_64.rpm	SHA-256: 00ccc0eb4192d56896297258715fa723b2adc2f0531830b218f392beafaf75ab
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.x86_64.rpm	SHA-256: 2cfb11a5993a05eae0ddded132dee8aba812405037ae3e0e4e619ac5ac9fd2ad
krb5-server-1.3.4-17.x86_64.rpm	SHA-256: c63bea758ce3b5f80638a8a9fbdf541992e42bfceda949f1e3e0abcd464aaac1
krb5-workstation-1.3.4-17.x86_64.rpm	SHA-256: 3480f951e0adf05041382b99a3f9a62d64321a6b9dde19d24db9667b014bea3f
ia64
krb5-devel-1.3.4-17.ia64.rpm	SHA-256: 6ec79564eb81f23aa670dda2f8a08476c398acda536284fd3266e10e2defdd7f
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.ia64.rpm	SHA-256: c94367c97e53396c7c8e61445678db833cbb0e573af01cc7f68c62524960971e
krb5-server-1.3.4-17.ia64.rpm	SHA-256: a4b477aeb3674fc17a7594d0e954d5649bfe09312d0e2d2e7011872b7ad57497
krb5-workstation-1.3.4-17.ia64.rpm	SHA-256: 50ce3bb1051d72a0c87fc62bdf42bf05339511ae655aed2323db755c25dfa310
i386
krb5-devel-1.3.4-17.i386.rpm	SHA-256: 19e7e6eb26916c7e817f12fee2293bb6be12bd74e202445b292baa0e354f00f9
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-server-1.3.4-17.i386.rpm	SHA-256: 86da9ab774e9e8bed06f8ebdfe9e5379c64aa30678ab63339d7abb926c59aa86
krb5-workstation-1.3.4-17.i386.rpm	SHA-256: 113f6ecee0f423c64e7828802cd2e66358c3358f576ad6d6362b46c618000488

Red Hat Enterprise Linux Desktop 4

SRPM
krb5-1.3.4-17.src.rpm	SHA-256: a2c5f1e4f590947e63f9c069854205915a48ba699f6ad4bde00e3ff0056debd3
x86_64
krb5-devel-1.3.4-17.x86_64.rpm	SHA-256: 00ccc0eb4192d56896297258715fa723b2adc2f0531830b218f392beafaf75ab
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-libs-1.3.4-17.x86_64.rpm	SHA-256: 2cfb11a5993a05eae0ddded132dee8aba812405037ae3e0e4e619ac5ac9fd2ad
krb5-server-1.3.4-17.x86_64.rpm	SHA-256: c63bea758ce3b5f80638a8a9fbdf541992e42bfceda949f1e3e0abcd464aaac1
krb5-workstation-1.3.4-17.x86_64.rpm	SHA-256: 3480f951e0adf05041382b99a3f9a62d64321a6b9dde19d24db9667b014bea3f
i386
krb5-devel-1.3.4-17.i386.rpm	SHA-256: 19e7e6eb26916c7e817f12fee2293bb6be12bd74e202445b292baa0e354f00f9
krb5-libs-1.3.4-17.i386.rpm	SHA-256: 092b520e12290087dff0e522bdf99660943f324f8dbd3af0d1c6d8f0200f5f48
krb5-server-1.3.4-17.i386.rpm	SHA-256: 86da9ab774e9e8bed06f8ebdfe9e5379c64aa30678ab63339d7abb926c59aa86
krb5-workstation-1.3.4-17.i386.rpm	SHA-256: 113f6ecee0f423c64e7828802cd2e66358c3358f576ad6d6362b46c618000488

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
krb5-1.3.4-17.src.rpm	SHA-256: a2c5f1e4f590947e63f9c069854205915a48ba699f6ad4bde00e3ff0056debd3
s390x
krb5-devel-1.3.4-17.s390x.rpm	SHA-256: 65fbf3fe03074e0777ef64388f1e42e721b1b3c146d88bdbaf447359756a26a6
krb5-libs-1.3.4-17.s390.rpm	SHA-256: 7f7e64ba26179d095206a0858e260cec9075a772b47d975e6faf28e8d6ee4fb0
krb5-libs-1.3.4-17.s390x.rpm	SHA-256: fdfe3a247c51b4d327e772ff0dd7e678de3e55507479b68291f331ab2986874b
krb5-server-1.3.4-17.s390x.rpm	SHA-256: b08b1269dc6628a5e90a892649c7d98d906a0edf4c46fa010815b1b73d4de4f9
krb5-workstation-1.3.4-17.s390x.rpm	SHA-256: b48908fb3d68a066047b9a155359013fab2584b277e1aceed2b0d0846fda1df2
s390
krb5-devel-1.3.4-17.s390.rpm	SHA-256: 0e571ac3aab0b2aaae4466a3061269b9535480a18a9138737abe03f2d9d3c192
krb5-libs-1.3.4-17.s390.rpm	SHA-256: 7f7e64ba26179d095206a0858e260cec9075a772b47d975e6faf28e8d6ee4fb0
krb5-server-1.3.4-17.s390.rpm	SHA-256: 4e1970705675ac72529826d975bb558c22ef61d18df295a0b881111ed023be33
krb5-workstation-1.3.4-17.s390.rpm	SHA-256: 2ab153329d32bad0715add927a46edc8c06284d51b5a274b2f3c357f6112c7b8

Red Hat Enterprise Linux for Power, big endian 4

SRPM
krb5-1.3.4-17.src.rpm	SHA-256: a2c5f1e4f590947e63f9c069854205915a48ba699f6ad4bde00e3ff0056debd3
ppc
krb5-devel-1.3.4-17.ppc.rpm	SHA-256: 42a2fed290a86bd172b82be9bc1c7bc8b841229d893a39c3320267f99caf4aba
krb5-libs-1.3.4-17.ppc.rpm	SHA-256: d492618343b44c8e93e3d5263fbd66ca4e418cfa5c157576741168e86390499a
krb5-libs-1.3.4-17.ppc64.rpm	SHA-256: aae36ee0a83ed77455b62f93982b7cde87f25c954197abb1a2d0944932c14ba9
krb5-server-1.3.4-17.ppc.rpm	SHA-256: 282ad36292e4909397866da147f5ad220f880cb7e451a5df2b97df1758c59fed
krb5-workstation-1.3.4-17.ppc.rpm	SHA-256: 42a1ef982b9932179ce7557c6546698ae29ad70e8ccad3313015fd81cf514aed