| Description: | Description:
The remote host is missing an update to krb5
announced via advisory FEDORA-2009-2852.
Update Information:
This update incorporates patches to fix potential read overflow and NULL pointer
dereferences in the implementation of the SPNEGO GSSAPI mechanism
(CVE-2009-0844, CVE-2009-0845), attempts to free an uninitialized pointer during
protocol parsing (CVE-2009-0846), and a bug in length validation during protocol
parsing (CVE-2009-0847).
ChangeLog:
* Tue Apr 7 2009 Nalin Dahyabhai 1.6.3-18
- add patches for read overflow and null pointer dereference in the
implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
- add patch for attempt to free uninitialized pointer in libkrb5
(CVE-2009-0846)
- add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
* Tue Mar 17 2009 Nalin Dahyabhai 1.6.3-17
- libgssapi_krb5: backport fix for some errors which can occur when
we fail to set up the server half of a context (CVE-2009-0845)
References:
[ 1 ] Bug #490634 - CVE-2009-0845 krb5: Null pointer dereference in GSSAPI SPNEGO security mechanism
https://bugzilla.redhat.com/show_bug.cgi?id=490634
[ 2 ] Bug #491033 - CVE-2009-0844 krb5: buffer over-read in SPNEGO GSS-API mechanism (MITKRB5-SA-2009-001)
https://bugzilla.redhat.com/show_bug.cgi?id=491033
[ 3 ] Bug #491036 - CVE-2009-0846 krb5: ASN.1 decoder can free uninitialized pointer when decoding an invalid encoding (MITKRB5-SA-2009-002)
https://bugzilla.redhat.com/show_bug.cgi?id=491036
[ 4 ] Bug #491034 - CVE-2009-0847 krb5: incorrect length check inside ASN.1 decoder (MITKRB5-SA-2009-001)
https://bugzilla.redhat.com/show_bug.cgi?id=491034
Solution: Apply the appropriate updates.
This update can be installed with the yum update program. Use
su -c 'yum update krb5' at the command line.
For more information, refer to Managing Software with yum,
available at http://docs.fedoraproject.org/yum/.
https://secure1.securityspace.com/smysecure/catid.html?in=FEDORA-2009-2852
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
