[SECURITY] Fedora Core 2 Update: krb5-1.3.3-7

[Nalin Dahyabhai]

---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-150
2004-06-04
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : krb5
Version     : 1.3.3                      
Release     : 7                  
Summary     : The Kerberos network authentication system.
Description :
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords.

---------------------------------------------------------------------
Update Information:

Bugs have been fixed in the krb5_aname_to_localname library function.
Specifically, buffer overflows were possible for all Kerberos
versions up to and including 1.3.3. The krb5_aname_to_localname
function translates a Kerberos principal name to a local account
name, typically a UNIX username.  This function is frequently used
when performing authorization checks.

If configured with mappings from particular Kerberos principals to
particular UNIX user names, certain functions called by
krb5_aname_to_localname will not properly check the lengths of
buffers used to store portions of the principal name. If configured
to map principals to user names using rules, krb5_aname_to_localname
would consistently write one byte past the end of a buffer allocated
from the heap. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0523 to this issue.

Only configurations which enable the explicit mapping or rules-based
mapping functionality of krb5_aname_to_localname() are vulnerable.
These configurations are not the default.

---------------------------------------------------------------------
* Fri Jun 04 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.3-7

- rebuild

* Fri Jun 04 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.3-6

- apply updated patch from MITKRB5-SA-2004-001 (revision 2004-06-02)

* Tue Jun 01 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.3-5

- rebuild

* Tue Jun 01 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.3-4

- apply patch from MITKRB5-SA-2004-001 (#125001)

* Wed May 12 2004 Thomas Woerner <twoerner at redhat.com> 1.3.3-3

- removed rpath

* Thu Apr 15 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.3-2

- re-enable large file support, fell out in 1.3-1
- patch rcp to use long long and %lld format specifiers when reporting file
  sizes on large files

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

437540335f79da1cbbc18d164e6215c0  SRPMS/krb5-1.3.3-7.src.rpm
cd6c377ee71fc3ac7a2ed1451632bc99  i386/krb5-devel-1.3.3-7.i386.rpm
4a4a06a0dd0bddb0bf9aefc35825029c  i386/krb5-libs-1.3.3-7.i386.rpm
f857845fde8315c8d6416e5d7befc605  i386/krb5-server-1.3.3-7.i386.rpm
84cc98e232f3834450b450d44dd9374a  i386/krb5-workstation-1.3.3-7.i386.rpm
1ee42664e020e7fa5a4a1c8202aabdee  i386/debug/krb5-debuginfo-1.3.3-7.i386.rpm
6dbdb3334974c1735a044deb2632e3a6  x86_64/krb5-devel-1.3.3-7.x86_64.rpm
864422b001ad11e0468ed53cbe6276fe  x86_64/krb5-libs-1.3.3-7.x86_64.rpm
606c96ce4814f686a99d7231aa5a6080  x86_64/krb5-server-1.3.3-7.x86_64.rpm
ad1573302d8702c705608d5f2803362d  x86_64/krb5-workstation-1.3.3-7.x86_64.rpm
6409ec2efcf54640e58451b32efb270a  x86_64/debug/krb5-debuginfo-1.3.3-7.x86_64.rpm
4a4a06a0dd0bddb0bf9aefc35825029c  x86_64/krb5-libs-1.3.3-7.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.  
---------------------------------------------------------------------

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://listman.redhat.com/archives/fedora-announce-list/attachments/20040604/d7607bba/attachment.sig>