Synopsis

Critical: krb5 security update

Type/Severity

Security Advisory: Critical

Topic

Updated krb5 packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 3, 4, and 5, and Red Hat Enterprise Linux 4.7,
5.2, and 5.3 Extended Update Support.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

Description

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other using symmetric encryption and a
trusted third party, the Key Distribution Center (KDC).

Multiple integer underflow flaws, leading to heap-based corruption, were
found in the way the MIT Kerberos Key Distribution Center (KDC) decrypted
ciphertexts encrypted with the Advanced Encryption Standard (AES) and
ARCFOUR (RC4) encryption algorithms. If a remote KDC client were able to
provide a specially-crafted AES- or RC4-encrypted ciphertext or texts, it
could potentially lead to either a denial of service of the central KDC
(KDC crash or abort upon processing the crafted ciphertext), or arbitrary
code execution with the privileges of the KDC (i.e., root privileges).
(CVE-2009-4212)

All krb5 users should upgrade to these updated packages, which contain a
backported patch to correct these issues. All running services using the
MIT Kerberos libraries must be restarted for the update to take effect.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server 3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.4 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.4 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.2 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.7 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Workstation 3 x86_64
• Red Hat Enterprise Linux Workstation 3 ia64
• Red Hat Enterprise Linux Workstation 3 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux Desktop 3 x86_64
• Red Hat Enterprise Linux Desktop 3 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems 3 s390x
• Red Hat Enterprise Linux for IBM z Systems 3 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.2 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian 3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.2 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 545015 - CVE-2009-4212 krb: KDC integer overflows in AES and RC4 decryption routines (MITKRB5-SA-2009-004)

CVEs

• CVE-2009-4212

References

• http://www.redhat.com/security/updates/classification/#critical
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-004.txt

Red Hat Enterprise Linux Server 5

SRPM
x86_64
krb5-devel-1.6.1-36.el5_4.1.i386.rpm	SHA-256: 969f91efe2892537aacd232a7d70ea92dc90f2fa239c20ec858d7a22f04219d9
krb5-devel-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: f1b7448bab7513ecc20e098ab21bb8e0889e0474ba78873e7159ce8f10ee8001
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016
krb5-libs-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: be28c5fb3b39a612904eee595764917e6e3fb86df3d2f824666f2635dad0d825
krb5-server-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: fe84b9542a4c52925d4f374994f1645d283e63c66f0e291a4d34f49d4395e4a9
krb5-workstation-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: a80039af0ff51e6bf165858e2b9fd1660446a5b3544f42cd6bebc3ebc2d3bc73
ia64
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016
i386
krb5-devel-1.6.1-36.el5_4.1.i386.rpm	SHA-256: 969f91efe2892537aacd232a7d70ea92dc90f2fa239c20ec858d7a22f04219d9
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
krb5-devel-1.6.1-36.el5_4.1.i386.rpm	SHA-256: 969f91efe2892537aacd232a7d70ea92dc90f2fa239c20ec858d7a22f04219d9
krb5-devel-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: f1b7448bab7513ecc20e098ab21bb8e0889e0474ba78873e7159ce8f10ee8001
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016
krb5-libs-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: be28c5fb3b39a612904eee595764917e6e3fb86df3d2f824666f2635dad0d825
krb5-server-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: fe84b9542a4c52925d4f374994f1645d283e63c66f0e291a4d34f49d4395e4a9
krb5-workstation-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: a80039af0ff51e6bf165858e2b9fd1660446a5b3544f42cd6bebc3ebc2d3bc73
i386
krb5-devel-1.6.1-36.el5_4.1.i386.rpm	SHA-256: 969f91efe2892537aacd232a7d70ea92dc90f2fa239c20ec858d7a22f04219d9
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016

Red Hat Enterprise Linux Desktop 5

SRPM
x86_64
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016
krb5-libs-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: be28c5fb3b39a612904eee595764917e6e3fb86df3d2f824666f2635dad0d825
krb5-workstation-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: a80039af0ff51e6bf165858e2b9fd1660446a5b3544f42cd6bebc3ebc2d3bc73
i386
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
krb5-devel-1.6.1-36.el5_4.1.i386.rpm	SHA-256: 969f91efe2892537aacd232a7d70ea92dc90f2fa239c20ec858d7a22f04219d9
krb5-devel-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: f1b7448bab7513ecc20e098ab21bb8e0889e0474ba78873e7159ce8f10ee8001
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016
krb5-libs-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: be28c5fb3b39a612904eee595764917e6e3fb86df3d2f824666f2635dad0d825
krb5-server-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: fe84b9542a4c52925d4f374994f1645d283e63c66f0e291a4d34f49d4395e4a9
krb5-workstation-1.6.1-36.el5_4.1.x86_64.rpm	SHA-256: a80039af0ff51e6bf165858e2b9fd1660446a5b3544f42cd6bebc3ebc2d3bc73
i386
krb5-devel-1.6.1-36.el5_4.1.i386.rpm	SHA-256: 969f91efe2892537aacd232a7d70ea92dc90f2fa239c20ec858d7a22f04219d9
krb5-libs-1.6.1-36.el5_4.1.i386.rpm	SHA-256: ad228596096c7ee5afab5ce131dc2979e7bf9f8d94ef31ffbfeed173e68ab016