Synopsis

Critical: krb5 security update

Type/Severity

Security Advisory: Critical

Topic

Updated krb5 packages that fix one security issue are now available for
Red Hat Enterprise Linux 3 Extended Life Cycle Support, 5.3 Long Life and
5.6 Extended Update Support

The Red Hat Security Response Team has rated this update as having critical
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.

Description

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other using symmetric encryption and a
trusted third-party, the Key Distribution Center (KDC).

A buffer overflow flaw was found in the MIT krb5 telnet daemon (telnetd).
A remote attacker who can access the telnet port of a target machine could
use this flaw to execute arbitrary code as root. (CVE-2011-4862)

Note that the krb5 telnet daemon is not enabled by default in any version
of Red Hat Enterprise Linux. In addition, the default firewall rules block
remote access to the telnet port. This flaw does not affect the telnet
daemon distributed in the telnet-server package.

For users who have installed the krb5-workstation package, have enabled the
telnet daemon, and have it accessible remotely, this update should be
applied immediately.

All krb5-workstation users should upgrade to these updated packages, which
contain a backported patch to correct this issue.

Solution

The krb5 telnet daemon is an xinetd service. You can determine if krb5
telnetd is enabled with the commands:

/sbin/chkconfig --list krb5-telnet
/sbin/chkconfig --list ekrb5-telnet

The output of these commands will display "on" if krb5 telnet is enabled.
krb5 telnet daemon can be immediately disabled with the commands:

/sbin/chkconfig krb5-telnet off
/sbin/chkconfig ekrb5-telnet off

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server - Extended Update Support 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.6 i386
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.6 x86_64
• Red Hat Enterprise Linux Server - AUS 5.6 ia64
• Red Hat Enterprise Linux Server - AUS 5.6 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 3 i386
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6 ppc

Fixes

• BZ - 770325 - CVE-2011-4862 krb5: remote buffer overflow in kerberized telnet daemon

CVEs

• CVE-2011-4862

References

• https://access.redhat.com/security/updates/classification/#critical
• http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-008.txt

Red Hat Enterprise Linux Server - Extended Update Support 5.6

SRPM
krb5-1.6.1-55.el5_6.3.src.rpm	SHA-256: 01dffe3024eb9d1a912792dcf4a339198d0662b582ee56256e32803b3cc3fad0
x86_64
krb5-devel-1.6.1-55.el5_6.3.i386.rpm	SHA-256: fd0e2c946d92d4382afb563561f57ef198a4931972be86794f45be5876c12128
krb5-devel-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: d9b29952299ddeaf62a9975837d626d0bc412cf863e86ed479ef3b8773b27d60
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-libs-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 1783416d2e503d11158af34a4d8e6838d8dccb91be16ac91536345b5688098b0
krb5-server-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: b0b2b14b6751aa2681fc19665fd49c70d4b1306e901046b9dd9d4a4e3a57e8eb
krb5-server-ldap-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 95572efddef3fe44995c32d0256f10747bb10ed04927b95773f0593c0fdf8602
krb5-workstation-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 25664db7a5a49acae3eabc8f65befd6c8b0fa6fc4593ca4ede4b228a130a065b
ia64
krb5-devel-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: b68933e066f40361c97bc068856a0cb9a44df240a95a0dd9431669e0151c4ad9
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-libs-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: 9bc34736729b5246d434786d68dbf3631566f363b0eb1eff6bf2d3194199660b
krb5-server-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: 618fc8a3621d5244bb9baa4ef4507b6b7230cedd5d2ebbf57bfd0803978fdf51
krb5-server-ldap-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: a040af055a9179b30523a335e6af499af7a03c255a44310baacd4defa2514769
krb5-workstation-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: 0d0e266e8f85ca4ee4c18b018a4bd6a73414b7821bbe5875bdd228758f4d357d
i386
krb5-devel-1.6.1-55.el5_6.3.i386.rpm	SHA-256: fd0e2c946d92d4382afb563561f57ef198a4931972be86794f45be5876c12128
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-server-1.6.1-55.el5_6.3.i386.rpm	SHA-256: 60e3edf080f5b45836e1709bbd650c2e54e0f014937fc1a6a00420ccc96baf77
krb5-server-ldap-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cb150d9f5c0f70a55eb06ea6aaee834611c0a033c64f81e3b33544ca5f535687
krb5-workstation-1.6.1-55.el5_6.3.i386.rpm	SHA-256: 041d0ad893b184b880e0812b7ff8163dee17135e3238ca2d7a3fe26ef18fb333

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.6

SRPM
krb5-1.6.1-55.el5_6.3.src.rpm	SHA-256: 01dffe3024eb9d1a912792dcf4a339198d0662b582ee56256e32803b3cc3fad0
ppc
krb5-devel-1.6.1-55.el5_6.3.ppc.rpm	SHA-256: e4ed6357c057fced392f326d6425a9c7d9ffb18a5337932516b4fa3549d6a930
krb5-devel-1.6.1-55.el5_6.3.ppc64.rpm	SHA-256: 8af9524c82ed63f8d820e2b9f0cd67b26e4c610685915883a18cc386b35f0da3
krb5-libs-1.6.1-55.el5_6.3.ppc.rpm	SHA-256: 7e4d743b8de342854c003d454c1b2bcbc9f792e46ef46eb2617e1354ff6d2b13
krb5-libs-1.6.1-55.el5_6.3.ppc64.rpm	SHA-256: 89dbf1ea7d0673d5242fe25b372cb391c98d691018ff016a65a6e11226034347
krb5-server-1.6.1-55.el5_6.3.ppc.rpm	SHA-256: 37de98cf59b42485793f2fb83670700fe21f33ba8bf511495169a911eccd7d2d
krb5-server-ldap-1.6.1-55.el5_6.3.ppc.rpm	SHA-256: d422262f97c79a65b89e1f452e653e82f7da9edb2f5f1b87604ff035d3c05e28
krb5-workstation-1.6.1-55.el5_6.3.ppc.rpm	SHA-256: 5f70d9b9ee62ed50b091dd21c61b68a03f1b6eb66df3ddae0e2f07670e03c1ba

Red Hat Enterprise Linux Server - Extended Update Support from RHUI 5.6

SRPM
krb5-1.6.1-55.el5_6.3.src.rpm	SHA-256: 01dffe3024eb9d1a912792dcf4a339198d0662b582ee56256e32803b3cc3fad0
x86_64
krb5-devel-1.6.1-55.el5_6.3.i386.rpm	SHA-256: fd0e2c946d92d4382afb563561f57ef198a4931972be86794f45be5876c12128
krb5-devel-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: d9b29952299ddeaf62a9975837d626d0bc412cf863e86ed479ef3b8773b27d60
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-libs-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 1783416d2e503d11158af34a4d8e6838d8dccb91be16ac91536345b5688098b0
krb5-server-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: b0b2b14b6751aa2681fc19665fd49c70d4b1306e901046b9dd9d4a4e3a57e8eb
krb5-server-ldap-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 95572efddef3fe44995c32d0256f10747bb10ed04927b95773f0593c0fdf8602
krb5-workstation-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 25664db7a5a49acae3eabc8f65befd6c8b0fa6fc4593ca4ede4b228a130a065b
i386
krb5-devel-1.6.1-55.el5_6.3.i386.rpm	SHA-256: fd0e2c946d92d4382afb563561f57ef198a4931972be86794f45be5876c12128
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-server-1.6.1-55.el5_6.3.i386.rpm	SHA-256: 60e3edf080f5b45836e1709bbd650c2e54e0f014937fc1a6a00420ccc96baf77
krb5-server-ldap-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cb150d9f5c0f70a55eb06ea6aaee834611c0a033c64f81e3b33544ca5f535687
krb5-workstation-1.6.1-55.el5_6.3.i386.rpm	SHA-256: 041d0ad893b184b880e0812b7ff8163dee17135e3238ca2d7a3fe26ef18fb333

Red Hat Enterprise Linux Server - AUS 5.6

SRPM
krb5-1.6.1-55.el5_6.3.src.rpm	SHA-256: 01dffe3024eb9d1a912792dcf4a339198d0662b582ee56256e32803b3cc3fad0
x86_64
krb5-devel-1.6.1-55.el5_6.3.i386.rpm	SHA-256: fd0e2c946d92d4382afb563561f57ef198a4931972be86794f45be5876c12128
krb5-devel-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: d9b29952299ddeaf62a9975837d626d0bc412cf863e86ed479ef3b8773b27d60
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-libs-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 1783416d2e503d11158af34a4d8e6838d8dccb91be16ac91536345b5688098b0
krb5-server-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: b0b2b14b6751aa2681fc19665fd49c70d4b1306e901046b9dd9d4a4e3a57e8eb
krb5-server-ldap-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 95572efddef3fe44995c32d0256f10747bb10ed04927b95773f0593c0fdf8602
krb5-workstation-1.6.1-55.el5_6.3.x86_64.rpm	SHA-256: 25664db7a5a49acae3eabc8f65befd6c8b0fa6fc4593ca4ede4b228a130a065b
ia64
krb5-devel-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: b68933e066f40361c97bc068856a0cb9a44df240a95a0dd9431669e0151c4ad9
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-libs-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: 9bc34736729b5246d434786d68dbf3631566f363b0eb1eff6bf2d3194199660b
krb5-server-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: 618fc8a3621d5244bb9baa4ef4507b6b7230cedd5d2ebbf57bfd0803978fdf51
krb5-server-ldap-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: a040af055a9179b30523a335e6af499af7a03c255a44310baacd4defa2514769
krb5-workstation-1.6.1-55.el5_6.3.ia64.rpm	SHA-256: 0d0e266e8f85ca4ee4c18b018a4bd6a73414b7821bbe5875bdd228758f4d357d
i386
krb5-devel-1.6.1-55.el5_6.3.i386.rpm	SHA-256: fd0e2c946d92d4382afb563561f57ef198a4931972be86794f45be5876c12128
krb5-libs-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cd4efaf6da8b4d53acdeff513cc8d0bf81245a5a52cff6e964d8aff16e1c730a
krb5-server-1.6.1-55.el5_6.3.i386.rpm	SHA-256: 60e3edf080f5b45836e1709bbd650c2e54e0f014937fc1a6a00420ccc96baf77
krb5-server-ldap-1.6.1-55.el5_6.3.i386.rpm	SHA-256: cb150d9f5c0f70a55eb06ea6aaee834611c0a033c64f81e3b33544ca5f535687
krb5-workstation-1.6.1-55.el5_6.3.i386.rpm	SHA-256: 041d0ad893b184b880e0812b7ff8163dee17135e3238ca2d7a3fe26ef18fb333

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.6

SRPM
krb5-1.6.1-55.el5_6.3.src.rpm	SHA-256: 01dffe3024eb9d1a912792dcf4a339198d0662b582ee56256e32803b3cc3fad0
s390x
krb5-devel-1.6.1-55.el5_6.3.s390.rpm	SHA-256: 7bd9534f27ad3c3e145b370d2489cacfb9e24e881c2162506fae8f4be2cf7e4e
krb5-devel-1.6.1-55.el5_6.3.s390x.rpm	SHA-256: 0364aedaedb2c93eeac5330ca89d746cf5ff457b53c0754c19ccff2a27de7e9e
krb5-libs-1.6.1-55.el5_6.3.s390.rpm	SHA-256: b6dde3e5fcef31b5f3b9eaf92baee12d6b034c08f8d4ab1f25a14839eec0306e
krb5-libs-1.6.1-55.el5_6.3.s390x.rpm	SHA-256: 4f34a39a17d8835fa6163985e3de5f4262a87ad14dbef378ca501be5bceaf2c4
krb5-server-1.6.1-55.el5_6.3.s390x.rpm	SHA-256: 00947b769cc182db9e0df7b35b7fb3eb694af2cf36f977061c23e7daf3e08dd8
krb5-server-ldap-1.6.1-55.el5_6.3.s390x.rpm	SHA-256: 968697f91f4f48bde79fc2f8047c9b1948cbb74eb16b3b6d5aa2aef754b03ef9
krb5-workstation-1.6.1-55.el5_6.3.s390x.rpm	SHA-256: 90cc68f3d3248824cd245c11f4eadc2c061a68a3543deabdc4ab6ffa684b43e9