1.118. krb5

Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.
The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) associated with each description below.
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).

Security Fixes

CVE-2011-1527, CVE-2011-1528, CVE-2011-1529
Multiple NULL pointer dereference and assertion failure flaws were found in the MIT Kerberos KDC when it was configured to use an LDAP (Lightweight Directory Access Protocol) or Berkeley Database (Berkeley DB) back end. A remote attacker could use these flaws to crash the KDC.
Red Hat would like to thank the MIT Kerberos project for reporting the CVE-2011-1527 issue. Upstream acknowledges Andrej Ota as the original reporter of CVE-2011-1527.
All krb5 users should upgrade to these updated packages, which contain a backported patch to correct these issues. After installing the updated packages, the krb5kdc daemon will be restarted automatically.
Updated krb5 packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.
Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).
Kerberos has been upgraded to version 1.9, which provides a number of bug fixes over the previous version. (BZ#642417)
Bug Fixes
BZ#595841, BZ#595842
Previously, no IPv6 suport was available for kprop, kpropd, kadmin and kadmind. This update adds IPv6 support to these utilities.
BZ#627039
Previously, the krbPwdExpiration attribute in the principal's entry would often be ignored when the realm database was stored in a directory server. This update fixes this problem and this attribute is no longer ignored.
BZ#629022
Previously, kinit with smart card login did not authenticate to the KDC correctly if the certificate on the smart card did not contain a subjectAltName extension or multiple certificates were available and krb5.conf was configured to select according to the value of the keyUsage extension in the certificates. This update continues to look for certificates with the right extension and corrects the valuation.
BZ#630587
Previously, the init script for the kpropd was not Linux Standards Base (LSB) compliant. With this update, this init script is LSB compliant.
BZ#630968
Previously, the KDC log files were not rotated by default. This update corrects this problem. Now these log files are rotated correctly.
BZ#646499
Previously, logins failed if the user had a .k5login file which did not explicitly contain the user's principal name. With this update, this check can be disabled using the "k5login_authoritative" setting in krb5.conf.
BZ#679612
Previously, GSSAPI authentication from Windows clients using cross-realm authentication failed if the client's ticket included a Privilege Attribute Certificate (PAC) with a failed signature check. Failed signature checks are now ignored.
All krb5 users are advised to upgrade to these updated packages, which fix these bugs.
Updated krb5 packages that fixes a bug is now available for Red Hat Enterprise Linux 6.
Kerberos is a network authentication system which allows clients and servers to authenticate to each other with the help of a trusted third party, a KDC (Key Distribution Center).
Bug Fix
BZ#714866
Certain versions of the KDC software (included for example in Red Hat Enterprise Linux 2.1 and 3) reject requests, which include KDC options the software does not recognize, and do not support the "canonicalize" option. When a client was configured to use one of these versions of the KDC software, the client failed to obtain credentials for authentication to other services. This interoperability regression was introduced in the update to Red Hat Enterprise Linux 6.1. With this update, an upstream patch has been provided to fix this bug.
Users of krb5 are advised to upgrade to these updated packages, which fix this bug.