Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2005.0532 -- RHSA-2005:567-02 and RHSA-2005:562-01 Important/Critical: krb5 security update 13 July 2005 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: krb5 Publisher: Red Hat Operating System: Red Hat Enterprise Linux AS/ES/WS 4 Red Hat Enterprise Linux Desktop 4 Red Hat Enterprise Linux AS/ES/WS 3 Red Hat Desktop 3 Red Hat Enterprise Linux AS/ES/WS 2.1 Red Hat Linux Advanced Workstation 2.1 Linux variants Impact: Execute Arbitrary Code/Commands Denial of Service Create Arbitrary Files Access: Remote/Unauthenticated CVE Names: CAN-2005-1689 CAN-2005-1175 CAN-2005-1174 CAN-2005-0488 CAN-2004-0175 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2005-567.html https://rhn.redhat.com/errata/RHSA-2005-562.html Comment: This ESB contains two Red Hat advisories relating to vulnerabilities in the Linux kernel. The two advisories are for Enterprise Linux versions 4 and 3/2.1 respectively. While the two Red Hat advisories contain bad PGP signatures, AusCERT has verified the information contained within them as valid. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: krb5 security update Advisory ID: RHSA-2005:567-02 Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-567.html Issue date: 2005-07-12 Updated on: 2005-07-12 Product: Red Hat Enterprise Linux Cross references: RHSA-2005:562 Obsoletes: RHSA-2005:330 CVE Names: CAN-2004-0175 CAN-2005-1174 CAN-2005-1175 CAN-2005-1689 - - --------------------------------------------------------------------- 1. Summary: Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Kerberos is a networked authentication system that uses a trusted third party (a KDC) to authenticate clients and servers to each other. A double-free flaw was found in the krb5_recvauth() routine which may be triggered by a remote unauthenticated attacker. Red Hat Enterprise Linux 4 contains checks within glibc that detect double-free flaws. Therefore, on Red Hat Enterprise Linux 4 successful exploitation of this issue can only lead to a denial of service (KDC crash). The Common Vulnerabilities and Exposures project assigned the name CAN-2005-1689 to this issue. Daniel Wachdorf discovered a single byte heap overflow in the krb5_unparse_name() function, part of krb5-libs. Sucessful exploitation of this flaw would lead to a denial of service (crash). To trigger this flaw an attacker would need to have control of a kerberos realm that shares a cross-realm key with the target, making exploitation of this flaw unlikely. (CAN-2005-1175). Daniel Wachdorf also discovered that in error conditions that may occur in response to correctly-formatted client requests, the Kerberos 5 KDC may attempt to free uninitialized memory. This could allow a remote attacker to cause a denial of service (KDC crash) (CAN-2005-1174). Gaël Delalleau discovered an information disclosure issue in the way some telnet clients handle messages from a server. An attacker could construct a malicious telnet server that collects information from the environment of any victim who connects to it using the Kerberos-aware telnet client (CAN-2005-0488). The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses the Kerberos-aware rcp to copy files from a malicious server (CAN-2004-0175). All users of krb5 should update to these erratum packages, which contain backported patches to correct these issues. Red Hat would like to thank the MIT Kerberos Development Team for their responsible disclosure of these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 157103 - CAN-2005-1174 krb5 buffer overflow, heap corruption in KDC (CAN-2005-1175) 159304 - CAN-2005-0488 telnet Information Disclosure Vulnerability 159756 - CAN-2005-1689 double-free in krb5_recvauth 161471 - krb5 krb5_principal_compare NULL pointer crash 161611 - CAN-2004-0175 malicious rsh server can cause rcp to write to arbitrary files 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/krb5-1.3.4-17.src.rpm eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm i386: 8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm 41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm ia64: e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm 23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm 47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm ppc: efa66e287518dd981a385f93dd087445 krb5-devel-1.3.4-17.ppc.rpm b01ebd176e288cadf3288162d5d45997 krb5-libs-1.3.4-17.ppc.rpm 6b57eff4d9b5506b45b749500b848838 krb5-libs-1.3.4-17.ppc64.rpm 4642ab1a5a73cb1fb4985cf7aa63003e krb5-server-1.3.4-17.ppc.rpm c4d951ee5954b2c7655c65af59e4cd6c krb5-workstation-1.3.4-17.ppc.rpm s390: 748be68de3ed9f3d40ce624322dc555e krb5-devel-1.3.4-17.s390.rpm f7b51e891da7442bf41d8297247dc1d5 krb5-libs-1.3.4-17.s390.rpm bfb93446ef2ab7b8a6d2a0ca0786aca5 krb5-server-1.3.4-17.s390.rpm ec219d6075667d8d7698e358d0d7e7ef krb5-workstation-1.3.4-17.s390.rpm s390x: 2370a9ceabc738c716ae515f598d4713 krb5-devel-1.3.4-17.s390x.rpm f7b51e891da7442bf41d8297247dc1d5 krb5-libs-1.3.4-17.s390.rpm b251dee235fdaaddfbc02dcf1106f5eb krb5-libs-1.3.4-17.s390x.rpm df7a2c26ac6a6f872ec3b8d33649bd8f krb5-server-1.3.4-17.s390x.rpm 79f44c1f3cf6e66892d6c40865ce8f72 krb5-workstation-1.3.4-17.s390x.rpm x86_64: 6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm 197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm 9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/krb5-1.3.4-17.src.rpm eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm i386: 8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm 41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm x86_64: 6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm 197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm 9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/krb5-1.3.4-17.src.rpm eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm i386: 8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm 41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm ia64: e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm 23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm 47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm x86_64: 6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm 197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm 9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/krb5-1.3.4-17.src.rpm eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm i386: 8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm 41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm ia64: e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm 23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm 47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm x86_64: 6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm 24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm 197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm 9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0175 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1174 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1175 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1689 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFC1A1FXlSAg2UNWIIRAgoRAKCuH08WzrJVtBUXB+kenSISHahRTwCeNyfz 7KQcZBE0oDxr5z0t7r9ZwQg= =q/Av - -----END PGP SIGNATURE----- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Critical: krb5 security update Advisory ID: RHSA-2005:562-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-562.html Issue date: 2005-07-12 Updated on: 2005-07-12 Product: Red Hat Enterprise Linux Cross references: RHSA-2005:567 Obsoletes: RHSA-2005:330 CVE Names: CAN-2004-0175 CAN-2005-0488 CAN-2005-1175 CAN-2005-1689 - - --------------------------------------------------------------------- 1. Summary: Updated krb5 packages which fix multiple security issues are now available for Red Hat Enterprise Linux 2.1 and 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: Kerberos is a networked authentication system which uses a trusted third party (a KDC) to authenticate clients and servers to each other. A double-free flaw was found in the krb5_recvauth() routine which may be triggered by a remote unauthenticated attacker. Although no exploit is currently known to exist, this issue could potentially be exploited to allow arbitrary code execution on a Key Distribution Center (KDC). The Common Vulnerabilities and Exposures project assigned the name CAN-2005-1689 to this issue. Daniel Wachdorf discovered a single byte heap overflow in the krb5_unparse_name() function, part of krb5-libs. Sucessful exploitation of this flaw would lead to a denial of service (crash). To trigger this flaw an attacker would need to have control of a kerberos realm that shares a cross-realm key with the target, making exploitation of this flaw unlikely. (CAN-2005-1175). Gaël Delalleau discovered an information disclosure issue in the way some telnet clients handle messages from a server. An attacker could construct a malicious telnet server that collects information from the environment of any victim who connects to it using the Kerberos-aware telnet client (CAN-2005-0488). The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses the Kerberos-aware rcp to copy files from a malicious server (CAN-2004-0175). All users of krb5 should update to these erratum packages which contain backported patches to correct these issues. Red Hat would like to thank the MIT Kerberos Development Team for their responsible disclosure of these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 159304 - CAN-2005-0488 telnet Information Disclosure Vulnerability 159753 - CAN-2005-1689 double-free in krb5_recvauth 161471 - krb5 krb5_principal_compare NULL pointer crash 161611 - CAN-2004-0175 malicious rsh server can cause rcp to write to arbitrary files 162255 - CAN-2005-1175 krb5 buffer overflow in KDC 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/krb5-1.2.2-37.src.rpm 5d772e7c740e732034b985eb5e7d7b41 krb5-1.2.2-37.src.rpm i386: 283a0ed8f883a7ad7b26b45cb016e8ca krb5-devel-1.2.2-37.i386.rpm 7cb388a856413589650647e0a9564cb1 krb5-libs-1.2.2-37.i386.rpm e9aa3596874efb262790e07ac672d3b6 krb5-server-1.2.2-37.i386.rpm 169c84674beb1695eb981fdd50b576a1 krb5-workstation-1.2.2-37.i386.rpm ia64: d7508a6995fe60eb2ef436d377539cec krb5-devel-1.2.2-37.ia64.rpm 088e0a0865d8239b28be7427920c784f krb5-libs-1.2.2-37.ia64.rpm 5aa88a1c23d6282d314038d20dc968bd krb5-server-1.2.2-37.ia64.rpm ca40819f1a408b1eb7415adae1951dd4 krb5-workstation-1.2.2-37.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/krb5-1.2.2-37.src.rpm 5d772e7c740e732034b985eb5e7d7b41 krb5-1.2.2-37.src.rpm ia64: d7508a6995fe60eb2ef436d377539cec krb5-devel-1.2.2-37.ia64.rpm 088e0a0865d8239b28be7427920c784f krb5-libs-1.2.2-37.ia64.rpm 5aa88a1c23d6282d314038d20dc968bd krb5-server-1.2.2-37.ia64.rpm ca40819f1a408b1eb7415adae1951dd4 krb5-workstation-1.2.2-37.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/krb5-1.2.2-37.src.rpm 5d772e7c740e732034b985eb5e7d7b41 krb5-1.2.2-37.src.rpm i386: 283a0ed8f883a7ad7b26b45cb016e8ca krb5-devel-1.2.2-37.i386.rpm 7cb388a856413589650647e0a9564cb1 krb5-libs-1.2.2-37.i386.rpm e9aa3596874efb262790e07ac672d3b6 krb5-server-1.2.2-37.i386.rpm 169c84674beb1695eb981fdd50b576a1 krb5-workstation-1.2.2-37.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/krb5-1.2.2-37.src.rpm 5d772e7c740e732034b985eb5e7d7b41 krb5-1.2.2-37.src.rpm i386: 283a0ed8f883a7ad7b26b45cb016e8ca krb5-devel-1.2.2-37.i386.rpm 7cb388a856413589650647e0a9564cb1 krb5-libs-1.2.2-37.i386.rpm e9aa3596874efb262790e07ac672d3b6 krb5-server-1.2.2-37.i386.rpm 169c84674beb1695eb981fdd50b576a1 krb5-workstation-1.2.2-37.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/krb5-1.2.7-47.src.rpm b8269d371eb18afe5f496a6da97c5c40 krb5-1.2.7-47.src.rpm i386: 61ed228798dfec78fe47f3a64a02853b krb5-devel-1.2.7-47.i386.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm 5872d358c01320902ccacd063a6121f6 krb5-server-1.2.7-47.i386.rpm d55268c2e3f2156ec4116fe088bb85b1 krb5-workstation-1.2.7-47.i386.rpm ia64: 2072d4e5f43da1792152e9b54ced0a17 krb5-devel-1.2.7-47.ia64.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm acfd537073b91f424bf50ebe8deac442 krb5-libs-1.2.7-47.ia64.rpm ae65b2188580cff61cc0312e4d5b3202 krb5-server-1.2.7-47.ia64.rpm cb0cb308aa0f1137c0daa669ec1ead24 krb5-workstation-1.2.7-47.ia64.rpm ppc: a903b06e058a287be57e2c7f0f94e980 krb5-devel-1.2.7-47.ppc.rpm 8a8469e3ef6a67eb496ad16559aa7405 krb5-libs-1.2.7-47.ppc.rpm 977ad9b12b867b889ff6bfd0b94c4a8f krb5-libs-1.2.7-47.ppc64.rpm 731d35f2b029c41a0b24891732bb4559 krb5-server-1.2.7-47.ppc.rpm 12d4e81ac7be9082782c78c899e433d8 krb5-workstation-1.2.7-47.ppc.rpm s390: 867e2d001c6980c0c5d0f37e714247ea krb5-devel-1.2.7-47.s390.rpm ee7b6ec8720ad8d9852d484c185165af krb5-libs-1.2.7-47.s390.rpm b048fb47c789862b45c6df459ad27d47 krb5-server-1.2.7-47.s390.rpm 1a0cfff73729877a6d82aba64d3f7e52 krb5-workstation-1.2.7-47.s390.rpm s390x: c80223d11f2563d11a057295860add78 krb5-devel-1.2.7-47.s390x.rpm ee7b6ec8720ad8d9852d484c185165af krb5-libs-1.2.7-47.s390.rpm 4d6fda2c87164c6292ec6b8edcea69f0 krb5-libs-1.2.7-47.s390x.rpm a95168d9021cc7c787c2de94afd38ebf krb5-server-1.2.7-47.s390x.rpm b6b382bbc101ef8287abc2b27e44d8b5 krb5-workstation-1.2.7-47.s390x.rpm x86_64: d467a180a18c6abcaad7c15406602417 krb5-devel-1.2.7-47.x86_64.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm b319c5aee6eca1f14b3ae009f54202b9 krb5-libs-1.2.7-47.x86_64.rpm 98ba88672f8710329630030b8de6712e krb5-server-1.2.7-47.x86_64.rpm ad10533e67f6047f378cafbf922fea77 krb5-workstation-1.2.7-47.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/krb5-1.2.7-47.src.rpm b8269d371eb18afe5f496a6da97c5c40 krb5-1.2.7-47.src.rpm i386: 61ed228798dfec78fe47f3a64a02853b krb5-devel-1.2.7-47.i386.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm d55268c2e3f2156ec4116fe088bb85b1 krb5-workstation-1.2.7-47.i386.rpm x86_64: d467a180a18c6abcaad7c15406602417 krb5-devel-1.2.7-47.x86_64.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm b319c5aee6eca1f14b3ae009f54202b9 krb5-libs-1.2.7-47.x86_64.rpm ad10533e67f6047f378cafbf922fea77 krb5-workstation-1.2.7-47.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/krb5-1.2.7-47.src.rpm b8269d371eb18afe5f496a6da97c5c40 krb5-1.2.7-47.src.rpm i386: 61ed228798dfec78fe47f3a64a02853b krb5-devel-1.2.7-47.i386.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm 5872d358c01320902ccacd063a6121f6 krb5-server-1.2.7-47.i386.rpm d55268c2e3f2156ec4116fe088bb85b1 krb5-workstation-1.2.7-47.i386.rpm ia64: 2072d4e5f43da1792152e9b54ced0a17 krb5-devel-1.2.7-47.ia64.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm acfd537073b91f424bf50ebe8deac442 krb5-libs-1.2.7-47.ia64.rpm ae65b2188580cff61cc0312e4d5b3202 krb5-server-1.2.7-47.ia64.rpm cb0cb308aa0f1137c0daa669ec1ead24 krb5-workstation-1.2.7-47.ia64.rpm x86_64: d467a180a18c6abcaad7c15406602417 krb5-devel-1.2.7-47.x86_64.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm b319c5aee6eca1f14b3ae009f54202b9 krb5-libs-1.2.7-47.x86_64.rpm 98ba88672f8710329630030b8de6712e krb5-server-1.2.7-47.x86_64.rpm ad10533e67f6047f378cafbf922fea77 krb5-workstation-1.2.7-47.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/krb5-1.2.7-47.src.rpm b8269d371eb18afe5f496a6da97c5c40 krb5-1.2.7-47.src.rpm i386: 61ed228798dfec78fe47f3a64a02853b krb5-devel-1.2.7-47.i386.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm d55268c2e3f2156ec4116fe088bb85b1 krb5-workstation-1.2.7-47.i386.rpm ia64: 2072d4e5f43da1792152e9b54ced0a17 krb5-devel-1.2.7-47.ia64.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm acfd537073b91f424bf50ebe8deac442 krb5-libs-1.2.7-47.ia64.rpm cb0cb308aa0f1137c0daa669ec1ead24 krb5-workstation-1.2.7-47.ia64.rpm x86_64: d467a180a18c6abcaad7c15406602417 krb5-devel-1.2.7-47.x86_64.rpm cd30cacc7f4eaa7b098b33feb06253df krb5-libs-1.2.7-47.i386.rpm b319c5aee6eca1f14b3ae009f54202b9 krb5-libs-1.2.7-47.x86_64.rpm ad10533e67f6047f378cafbf922fea77 krb5-workstation-1.2.7-47.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-003-recvauth.txt http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2005-002-kdc.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0175 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0488 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1175 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1689 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFC1A0yXlSAg2UNWIIRAqHhAJ9qUYUzVa0SMBxwiMnPvK8qh3jWGgCfSA50 gxvbJ/8prTsXziguyas+vZ0= =RPDC - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBQtR36ih9+71yA2DNAQJ3lQQAktr+z3Z/GjahRCPUSOzq5xSVidjK1MJj 8NWFn+FeSwfK8V67AR9ahpzYAEe6P7LgmmnnebmF+B6eZFYvCRcKWsFlfyi76dlA dio+g7cS+tidK5uY6I0zTNSrhMfBFiGvZ0YKK+ky9n3PaJX6w6GDHAz2A9r1VutK +xdvbFBJ6JI= =RHIU -----END PGP SIGNATURE-----