| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2010:0029.
Kerberos is a network authentication system which allows clients and
servers to authenticate to each other using symmetric encryption and a
trusted third party, the Key Distribution Center (KDC).
Multiple integer underflow flaws, leading to heap-based corruption, were
found in the way the MIT Kerberos Key Distribution Center (KDC) decrypted
ciphertexts encrypted with the Advanced Encryption Standard (AES) and
ARCFOUR (RC4) encryption algorithms. If a remote KDC client were able to
provide a specially-crafted AES- or RC4-encrypted ciphertext or texts, it
could potentially lead to either a denial of service of the central KDC
(KDC crash or abort upon processing the crafted ciphertext), or arbitrary
code execution with the privileges of the KDC (i.e., root privileges).
(CVE-2009-4212)
All krb5 users should upgrade to these updated packages, which contain a
backported patch to correct these issues. All running services using the
MIT Kerberos libraries must be restarted for the update to take effect.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2010-0029.html
http://www.redhat.com/security/updates/classification/#critical
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2009-004.txt
Risk factor : Critical
CVSS Score:
10.0
|
