| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2004:448.
Kerberos is a networked authentication system that uses a trusted third
party (a KDC) to authenticate clients and servers to each other.
Several double-free bugs were found in the Kerberos 5 KDC and libraries. A
remote attacker could potentially exploit these flaws to execute arbitrary
code. The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CVE-2004-0642 and CVE-2004-0643 to these issues.
A double-free bug was also found in the krb524 server (CVE-2004-0772),
however this issue was fixed for Red Hat Enterprise Linux 2.1 users by a
previous erratum, RHSA-2003:052.
An infinite loop bug was found in the Kerberos 5 ASN.1 decoder library. A
remote attacker may be able to trigger this flaw and cause a denial of
service. The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2004-0644 to this issue.
All users of krb5 should upgrade to these updated packages, which contain
backported security patches to resolve these issues.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2004-448.html
http://web.mit.edu/kerberos/advisories/
Risk factor : High
CVSS Score:
7.5
|
