Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


Top White Papers

More on LinuxToday


Red Hat Security Advisory: Updated Kerberos 5 and pam_krb5 packages available

Mar 28, 2001, 20:39 (1 Talkback[s])

Date: Tue, 27 Mar 2001 15:24:00 -0500
From: bugzilla@REDHAT.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: [RHSA-2001:025-14] Updated Kerberos 5 and pam_krb5 packages available


                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated Kerberos 5 and pam_krb5 packages available
Advisory ID:       RHSA-2001:025-14
Issue date:        2001-03-08
Updated on:        2001-03-27
Product:           Red Hat Linux
Keywords:          kerberos libkrb4 race
Cross references:
Obsoletes:         RHSA-2000:025

1. Topic:

Updated Kerberos 5 packages are now available for Red Hat Linux 6 and 7. These packages fix a vulnerability in the handling of Kerberos IV ticket files. Updated pam_krb5 packages are now available for Red Hat Linux 7.

2. Relevant releases/architectures:

Red Hat Linux 6.2 - alpha, i386, sparc
Red Hat Linux 7.0 - alpha, i386

3. Problem description:

A race condition exists in libkrb4 which would allow a malicious user to cause kerberized login services to overwrite the contents of any file on the system. The destroyed file would contain the kerberos credentials of an unsuspecting user who had attempted to log in using the kerberized login service being exploited.

Additional precautions taken in Kerberos 5 1.2.2 will cause pam_krb5 to fail when it attempts to create Kerberos IV ticket files on behalf of users. An update for the pam_krb5 package is also available which corrects this.

4. Solution:

To update all RPMs for your particular architecture, run:

rpm -Fvh <filenames>

where <filenames> is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directly *only* contains the desired RPMs.

Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

11588 - RH6.2 krb5 errata breaks credential forwarding over rsh
14301 - workstation 1.1.1-21 ftp core dumps on put nfs* when symlink present.

6. RPMs required:

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/SRPMS/krb5-1.1.1-26.src.rpm

alpha:
ftp://updates.redhat.com/6.2/alpha/krb5-configs-1.1.1-26.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/krb5-devel-1.1.1-26.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/krb5-libs-1.1.1-26.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/krb5-server-1.1.1-26.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/krb5-workstation-1.1.1-26.alpha.rpm

i386:
ftp://updates.redhat.com/6.2/i386/krb5-configs-1.1.1-26.i386.rpm
ftp://updates.redhat.com/6.2/i386/krb5-devel-1.1.1-26.i386.rpm
ftp://updates.redhat.com/6.2/i386/krb5-libs-1.1.1-26.i386.rpm
ftp://updates.redhat.com/6.2/i386/krb5-server-1.1.1-26.i386.rpm
ftp://updates.redhat.com/6.2/i386/krb5-workstation-1.1.1-26.i386.rpm

sparc:
ftp://updates.redhat.com/6.2/sparc/krb5-configs-1.1.1-26.sparc.rpm
ftp://updates.redhat.com/6.2/sparc/krb5-devel-1.1.1-26.sparc.rpm
ftp://updates.redhat.com/6.2/sparc/krb5-libs-1.1.1-26.sparc.rpm
ftp://updates.redhat.com/6.2/sparc/krb5-server-1.1.1-26.sparc.rpm
ftp://updates.redhat.com/6.2/sparc/krb5-workstation-1.1.1-26.sparc.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/SRPMS/krb5-1.2.2-3.src.rpm
ftp://updates.redhat.com/7.0/SRPMS/pam_krb5-1.29-1.src.rpm

alpha:
ftp://updates.redhat.com/7.0/alpha/krb5-devel-1.2.2-3.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/krb5-libs-1.2.2-3.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/krb5-server-1.2.2-3.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/krb5-workstation-1.2.2-3.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/pam_krb5-1.29-1.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/i386/krb5-devel-1.2.2-3.i386.rpm
ftp://updates.redhat.com/7.0/i386/krb5-libs-1.2.2-3.i386.rpm
ftp://updates.redhat.com/7.0/i386/krb5-server-1.2.2-3.i386.rpm
ftp://updates.redhat.com/7.0/i386/krb5-workstation-1.2.2-3.i386.rpm
ftp://updates.redhat.com/7.0/i386/pam_krb5-1.29-1.i386.rpm

7. Verification:

MD5 sum                           Package Name

7041be9b57bb7249574a5a246066ae61 6.2/SRPMS/krb5-1.1.1-26.src.rpm
e57ce788eca9711d182552b0350905d8 6.2/alpha/krb5-configs-1.1.1-26.alpha.rpm
f36bdc4f5835f1e0217dfd700837cdf9 6.2/alpha/krb5-devel-1.1.1-26.alpha.rpm
22dd9ec7c70baea4be95b83fe3cbb2ce 6.2/alpha/krb5-libs-1.1.1-26.alpha.rpm
224c44e25f70dbc54c5a6d648e4c6313 6.2/alpha/krb5-server-1.1.1-26.alpha.rpm
b5ddbc92d431a915446f9d67005971d6 6.2/alpha/krb5-workstation-1.1.1-26.alpha.rpm
545e22aaa62be18e9fbf563cc598d76a 6.2/i386/krb5-configs-1.1.1-26.i386.rpm
92428079be93de3fbeb3978fc497ced9 6.2/i386/krb5-devel-1.1.1-26.i386.rpm
c7e015d80d88067e78586b146ec37c9e 6.2/i386/krb5-libs-1.1.1-26.i386.rpm
7d53d769b76e65ba39a7811ccb25e274 6.2/i386/krb5-server-1.1.1-26.i386.rpm
cef0175a7b3ef6ef94cb3e04b6a86e67 6.2/i386/krb5-workstation-1.1.1-26.i386.rpm
1e06847c54890ed7bcb282f2fa4fab19 6.2/sparc/krb5-configs-1.1.1-26.sparc.rpm
5da36dc1c30528be46a30fb759f5163a 6.2/sparc/krb5-devel-1.1.1-26.sparc.rpm
b5999a74da573b493a4080fa37858943 6.2/sparc/krb5-libs-1.1.1-26.sparc.rpm
a1b6fbe0c70f481aa95aee59f53d7081 6.2/sparc/krb5-server-1.1.1-26.sparc.rpm
4d98e8df011616e0869bdfcca9c0442f 6.2/sparc/krb5-workstation-1.1.1-26.sparc.rpm
c4da9f2ac64d7f59c40fab1a3c3586ce 7.0/SRPMS/krb5-1.2.2-3.src.rpm
f22030ebe5580c7bf0d70f43bbbb4a67 7.0/SRPMS/pam_krb5-1.29-1.src.rpm
f692e70599181623d7c709b4eeea949b 7.0/alpha/krb5-devel-1.2.2-3.alpha.rpm
a1fa2ae040c8cc7dc26acdb6bc05a494 7.0/alpha/krb5-libs-1.2.2-3.alpha.rpm
711e54bf1f4d6af2507fc7f0640cfdbc 7.0/alpha/krb5-server-1.2.2-3.alpha.rpm
1b1cc01a728807494640d178db7f8b66 7.0/alpha/krb5-workstation-1.2.2-3.alpha.rpm
78374857b86d974ef373165c94dca18f 7.0/alpha/pam_krb5-1.29-1.alpha.rpm
e973b9b830d31f0bdd27b3cf703486fd 7.0/i386/krb5-devel-1.2.2-3.i386.rpm
56f6429dc0e346ebdc3997c1a84d4a34 7.0/i386/krb5-libs-1.2.2-3.i386.rpm
1e88d30acf76d26a2a80affd8f3cf444 7.0/i386/krb5-server-1.2.2-3.i386.rpm
9605d6cb0049f7b68a94d44155dd470e 7.0/i386/krb5-workstation-1.2.2-3.i386.rpm
fbf60c1b273d86c0388be4b1921fbe37 7.0/i386/pam_krb5-1.29-1.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key is available at:
http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
rpm --checksig <filename>

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>

8. References:

http://web.mit.edu/kerberos/www/advisories/krb4tkt.txt

Copyright(c) 2000, 2001 Red Hat, Inc.