Synopsis

Critical: krb5 security update

Type/Severity

Security Advisory: Critical

Topic

Updated krb5 packages that fix one security issue are now available for
Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having Critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Kerberos is a network authentication system which allows clients and servers
to authenticate to each other using symmetric encryption and a trusted third-
party, the Key Distribution Center (KDC).

A buffer overflow flaw was found in the MIT krb5 telnet daemon (telnetd). A
remote attacker who can access the telnet port of a target machine could use
this flaw to execute arbitrary code as root. (CVE-2011-4862)

Note that the krb5 telnet daemon is not enabled by default in any version of
Red Hat Enterprise Linux. In addition, the default firewall rules block
remote access to the telnet port. This flaw does not affect the telnet
daemon distributed in the telnet-server package.

For users who have installed the krb5-workstation package, have enabled the
telnet daemon, and have it accessible remotely, this update should be
applied immediately.

All krb5-workstation users should upgrade to these updated packages, which
contain a backported patch to correct this issue.

Solution

The krb5 telnet daemon is an xinetd service. You can determine if krb5
telnetd is enabled with the commands:

/sbin/chkconfig --list krb5-telnet
/sbin/chkconfig --list ekrb5-telnet

The output of these commands will display "on" if krb5 telnet is enabled.
krb5 telnet daemon can be immediately disabled with the commands:

/sbin/chkconfig krb5-telnet off
/sbin/chkconfig ekrb5-telnet off

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 770325 - CVE-2011-4862 krb5-appl: remote buffer overflow in kerberised telnet daemon

CVEs

• CVE-2011-4862

References

• https://access.redhat.com/security/updates/classification/#critical
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt

Red Hat Enterprise Linux Server 5

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Server 4

SRPM
krb5-1.3.4-65.el4.src.rpm	SHA-256: adfcf759a909976fcb544f634349869e2ea59a5a963f18dd87d4bbec491473d7
x86_64
krb5-devel-1.3.4-65.el4.x86_64.rpm	SHA-256: 334eed25741af9268112d4c861f3e3ed9bedc677bb4999cf15dff161d2649f73
krb5-devel-1.3.4-65.el4.x86_64.rpm	SHA-256: 334eed25741af9268112d4c861f3e3ed9bedc677bb4999cf15dff161d2649f73
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.x86_64.rpm	SHA-256: 8b827ca6dd66d96b0f8f066d5d78ad2da636a00a84ba0143f397755babc79b05
krb5-libs-1.3.4-65.el4.x86_64.rpm	SHA-256: 8b827ca6dd66d96b0f8f066d5d78ad2da636a00a84ba0143f397755babc79b05
krb5-server-1.3.4-65.el4.x86_64.rpm	SHA-256: 4528d57158b7a08674cf0a9bfd8d706a7b56ee27cc4dee9226651fc3dbfac124
krb5-server-1.3.4-65.el4.x86_64.rpm	SHA-256: 4528d57158b7a08674cf0a9bfd8d706a7b56ee27cc4dee9226651fc3dbfac124
krb5-workstation-1.3.4-65.el4.x86_64.rpm	SHA-256: 6a24251013ed7933da2e437e81781ae12d840f2451a7fe63bc9475b45f6ebea2
krb5-workstation-1.3.4-65.el4.x86_64.rpm	SHA-256: 6a24251013ed7933da2e437e81781ae12d840f2451a7fe63bc9475b45f6ebea2
ia64
krb5-devel-1.3.4-65.el4.ia64.rpm	SHA-256: ece824a7eb81593fe44f56ae2d3d5131ecc28f3fe50b982ebcc4a3290197fb01
krb5-devel-1.3.4-65.el4.ia64.rpm	SHA-256: ece824a7eb81593fe44f56ae2d3d5131ecc28f3fe50b982ebcc4a3290197fb01
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.ia64.rpm	SHA-256: a78dab33b2ff507f18aa2bd3234aba64d3b4b512f2175b74b86fb2873a8f2419
krb5-libs-1.3.4-65.el4.ia64.rpm	SHA-256: a78dab33b2ff507f18aa2bd3234aba64d3b4b512f2175b74b86fb2873a8f2419
krb5-server-1.3.4-65.el4.ia64.rpm	SHA-256: 1ad463ee88749084a07e76bb8ef2b52de1947afdbbc34fbd80f761f80a5e3606
krb5-server-1.3.4-65.el4.ia64.rpm	SHA-256: 1ad463ee88749084a07e76bb8ef2b52de1947afdbbc34fbd80f761f80a5e3606
krb5-workstation-1.3.4-65.el4.ia64.rpm	SHA-256: 75bf61dee6cf1c1f18e231d5a2664c9f0a186d1a550d9285415a08723e25e563
krb5-workstation-1.3.4-65.el4.ia64.rpm	SHA-256: 75bf61dee6cf1c1f18e231d5a2664c9f0a186d1a550d9285415a08723e25e563
i386
krb5-devel-1.3.4-65.el4.i386.rpm	SHA-256: 2e4bef57620d0112bf8609b8304aafba3c2dc19e8078f1e9c6e7bb77dbe6e0f9
krb5-devel-1.3.4-65.el4.i386.rpm	SHA-256: 2e4bef57620d0112bf8609b8304aafba3c2dc19e8078f1e9c6e7bb77dbe6e0f9
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-server-1.3.4-65.el4.i386.rpm	SHA-256: b4ef67ab5509bef953c64fe4af22f75eefbb04cfb879e8f5c943953fe14a9d3a
krb5-server-1.3.4-65.el4.i386.rpm	SHA-256: b4ef67ab5509bef953c64fe4af22f75eefbb04cfb879e8f5c943953fe14a9d3a
krb5-workstation-1.3.4-65.el4.i386.rpm	SHA-256: 3e65905be0d1fb96a820752ed049e0e33b9b44fef13f80530b4bfaeaf2754222
krb5-workstation-1.3.4-65.el4.i386.rpm	SHA-256: 3e65905be0d1fb96a820752ed049e0e33b9b44fef13f80530b4bfaeaf2754222

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
i386

Red Hat Enterprise Linux Workstation 4

SRPM
krb5-1.3.4-65.el4.src.rpm	SHA-256: adfcf759a909976fcb544f634349869e2ea59a5a963f18dd87d4bbec491473d7
x86_64
krb5-devel-1.3.4-65.el4.x86_64.rpm	SHA-256: 334eed25741af9268112d4c861f3e3ed9bedc677bb4999cf15dff161d2649f73
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.x86_64.rpm	SHA-256: 8b827ca6dd66d96b0f8f066d5d78ad2da636a00a84ba0143f397755babc79b05
krb5-server-1.3.4-65.el4.x86_64.rpm	SHA-256: 4528d57158b7a08674cf0a9bfd8d706a7b56ee27cc4dee9226651fc3dbfac124
krb5-workstation-1.3.4-65.el4.x86_64.rpm	SHA-256: 6a24251013ed7933da2e437e81781ae12d840f2451a7fe63bc9475b45f6ebea2
ia64
krb5-devel-1.3.4-65.el4.ia64.rpm	SHA-256: ece824a7eb81593fe44f56ae2d3d5131ecc28f3fe50b982ebcc4a3290197fb01
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.ia64.rpm	SHA-256: a78dab33b2ff507f18aa2bd3234aba64d3b4b512f2175b74b86fb2873a8f2419
krb5-server-1.3.4-65.el4.ia64.rpm	SHA-256: 1ad463ee88749084a07e76bb8ef2b52de1947afdbbc34fbd80f761f80a5e3606
krb5-workstation-1.3.4-65.el4.ia64.rpm	SHA-256: 75bf61dee6cf1c1f18e231d5a2664c9f0a186d1a550d9285415a08723e25e563
i386
krb5-devel-1.3.4-65.el4.i386.rpm	SHA-256: 2e4bef57620d0112bf8609b8304aafba3c2dc19e8078f1e9c6e7bb77dbe6e0f9
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-server-1.3.4-65.el4.i386.rpm	SHA-256: b4ef67ab5509bef953c64fe4af22f75eefbb04cfb879e8f5c943953fe14a9d3a
krb5-workstation-1.3.4-65.el4.i386.rpm	SHA-256: 3e65905be0d1fb96a820752ed049e0e33b9b44fef13f80530b4bfaeaf2754222

Red Hat Enterprise Linux Desktop 5

SRPM
x86_64
i386

Red Hat Enterprise Linux Desktop 4

SRPM
krb5-1.3.4-65.el4.src.rpm	SHA-256: adfcf759a909976fcb544f634349869e2ea59a5a963f18dd87d4bbec491473d7
x86_64
krb5-devel-1.3.4-65.el4.x86_64.rpm	SHA-256: 334eed25741af9268112d4c861f3e3ed9bedc677bb4999cf15dff161d2649f73
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-libs-1.3.4-65.el4.x86_64.rpm	SHA-256: 8b827ca6dd66d96b0f8f066d5d78ad2da636a00a84ba0143f397755babc79b05
krb5-server-1.3.4-65.el4.x86_64.rpm	SHA-256: 4528d57158b7a08674cf0a9bfd8d706a7b56ee27cc4dee9226651fc3dbfac124
krb5-workstation-1.3.4-65.el4.x86_64.rpm	SHA-256: 6a24251013ed7933da2e437e81781ae12d840f2451a7fe63bc9475b45f6ebea2
i386
krb5-devel-1.3.4-65.el4.i386.rpm	SHA-256: 2e4bef57620d0112bf8609b8304aafba3c2dc19e8078f1e9c6e7bb77dbe6e0f9
krb5-libs-1.3.4-65.el4.i386.rpm	SHA-256: b9f91269241ae22fc778b1289a1a0cf59017570b652f548b97914207a760821e
krb5-server-1.3.4-65.el4.i386.rpm	SHA-256: b4ef67ab5509bef953c64fe4af22f75eefbb04cfb879e8f5c943953fe14a9d3a
krb5-workstation-1.3.4-65.el4.i386.rpm	SHA-256: 3e65905be0d1fb96a820752ed049e0e33b9b44fef13f80530b4bfaeaf2754222

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
s390x

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
krb5-1.3.4-65.el4.src.rpm	SHA-256: adfcf759a909976fcb544f634349869e2ea59a5a963f18dd87d4bbec491473d7
s390x
krb5-devel-1.3.4-65.el4.s390x.rpm	SHA-256: 4681bd7c0e8ed6ca8afe385bfae6b813dbb332502b40b75063d90dfcca5b1ba5
krb5-libs-1.3.4-65.el4.s390.rpm	SHA-256: a0ba5223d9d1ed2592c06ff22693487caf6c97592070d96825fc79c7bd0f8158
krb5-libs-1.3.4-65.el4.s390x.rpm	SHA-256: ea4958f4895e8c34660434f93a4c01008789ee27faf1593bd4fe542b165728a1
krb5-server-1.3.4-65.el4.s390x.rpm	SHA-256: 13416a5b1a0ec5cbef6eca41f4e53291842cdcfb12ee08e5e44477a5bcec0292
krb5-workstation-1.3.4-65.el4.s390x.rpm	SHA-256: e7645273778e1ce356f017d412701ca749352c4aca63dd0bf9f831b751f7eb04
s390
krb5-devel-1.3.4-65.el4.s390.rpm	SHA-256: da4d009f4f1705e551070ec5a72f3f518817b2b9bf9a6d8689ce0dde23d62b02
krb5-libs-1.3.4-65.el4.s390.rpm	SHA-256: a0ba5223d9d1ed2592c06ff22693487caf6c97592070d96825fc79c7bd0f8158
krb5-server-1.3.4-65.el4.s390.rpm	SHA-256: 3ab33a6618f1b32e803836463cad1ececf068e84be1f32f4eba16db8b11af305
krb5-workstation-1.3.4-65.el4.s390.rpm	SHA-256: 25bdc252a51729ef51585fd1861e9ffbbb8274b57a9d64abc5f22c0065d7b433

Red Hat Enterprise Linux for Power, big endian 5

SRPM
ppc

Red Hat Enterprise Linux for Power, big endian 4

SRPM
krb5-1.3.4-65.el4.src.rpm	SHA-256: adfcf759a909976fcb544f634349869e2ea59a5a963f18dd87d4bbec491473d7
ppc
krb5-devel-1.3.4-65.el4.ppc.rpm	SHA-256: 4a1aaec5d2d63dad997fc9034d2fc0b86381f6011e4abc058f1bc4673bcdd013
krb5-libs-1.3.4-65.el4.ppc.rpm	SHA-256: 745274202d1fd9f63d0ad5c7f3ccc64cb49e93c5b2e4570b83c3b1c5991619b0
krb5-libs-1.3.4-65.el4.ppc64.rpm	SHA-256: 2592d37f40098e3e0fd07460b7c4518aca64ed90c569ff237502d758a15ab7f0
krb5-server-1.3.4-65.el4.ppc.rpm	SHA-256: 99d12bd061aa4accc31f5abefe15cc4c70daa54a3c49b57d1a6a9a63e822db92
krb5-workstation-1.3.4-65.el4.ppc.rpm	SHA-256: 333a816061b57e0839d6a3a252ff3139c8980d9a49266c7fef3d9c33f50e2411

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
i386