[UCI-Linux] [SECURITY] Fedora Core 2 Update: krb5-1.3.4-6

Mike Iglesias IGLESIAS at uci.edu
Wed Sep 1 10:08:54 PDT 2004


Date: Tue, 31 Aug 2004 14:26:18 -0400
From: Nalin Dahyabhai <nalin at redhat.com>
To: fedora-announce-list at redhat.com
Message-ID: <20040831182618.GA3333 at redhat.com>
Mime-Version: 1.0
User-Agent: Mutt/1.4.1i
Subject: [SECURITY] Fedora Core 2 Update: krb5-1.3.4-6


--===============1926555165==
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="8t9RHnE3ZwKMSgU+"
Content-Disposition: inline


--8t9RHnE3ZwKMSgU+
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2004-277
2004-08-31
---------------------------------------------------------------------

Product     : Fedora Core 2
Name        : krb5
Version     : 1.3.4                     =20
Release     : 6                 =20
Summary     : The Kerberos network authentication system.
Description :
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords.

---------------------------------------------------------------------
Update Information:

Kerberos is a networked authentication system which uses a trusted
third party (a KDC) to authenticate clients and servers to each
other.

Several double-free bugs were found in the Kerberos 5 KDC and
libraries. A remote attacker could potentially exploit these flaws to
execute arbitrary code. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the names CAN-2004-0642 and
CAN-2004-0643 to these issues.

A double-free bug was also found in the krb524 server
(CAN-2004-0772), however this issue does not affect Fedora Core.

An infinite loop bug was found in the Kerberos 5 ASN.1 decoder
library. A remote attacker may be able to trigger this flaw and cause
a denial of service. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0644 to this issue.

---------------------------------------------------------------------
* Tue Aug 24 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.4-6

- rebuild

* Tue Aug 24 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.4-5

- incorporate revised fixes from Tom Yu for CAN-2004-0642, CAN-2004-0644,
  CAN-2004-0772

* Mon Aug 23 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.4-4

- rebuild

* Mon Aug 23 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.4-3

- incorporate fixes from Tom Yu for CAN-2004-0642, CAN-2004-0772
  (MITKRB5-SA-2004-002, #130732)
- incorporate fixes from Tom Yu for CAN-2004-0644 (MITKRB5-SA-2004-003, #13=
0732)

* Tue Jul 27 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.4-2

- fix indexing error in server sorting patch (#127336)

* Tue Jun 15 2004 Elliot Lee <sopwith at redhat.com>

- rebuilt

* Mon Jun 14 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.4-0.1

- update to 1.3.4 final

* Mon Jun 07 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.4-0

- update to 1.3.4 beta1
- remove MITKRB5-SA-2004-001, included in 1.3.4

* Mon Jun 07 2004 Nalin Dahyabhai <nalin at redhat.com> 1.3.3-8

- rebuild

---------------------------------------------------------------------
This update can be downloaded from:
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

2b26718a3e533f32a1e98b401a2e21d4  SRPMS/krb5-1.3.4-6.src.rpm
beebe2125e840d9cb4546465b9833d66  x86_64/krb5-devel-1.3.4-6.x86_64.rpm
e00056df9058bed4b00684d2a64ffbe6  x86_64/krb5-libs-1.3.4-6.x86_64.rpm
abe8cf2e80236fb5a6adfa62c6e13240  x86_64/krb5-server-1.3.4-6.x86_64.rpm
11fdd50862bc0379fbfb3d804e59143b  x86_64/krb5-workstation-1.3.4-6.x86_64.rpm
a6abcfdeb10910b7b814391c720d2ae7  x86_64/debug/krb5-debuginfo-1.3.4-6.x86_6=
4.rpm
1d720b00203ce00d4c75e3926ee618e4  x86_64/krb5-libs-1.3.4-6.i386.rpm
16d556d502f9d34729bcb166ec209ea8  i386/krb5-devel-1.3.4-6.i386.rpm
1d720b00203ce00d4c75e3926ee618e4  i386/krb5-libs-1.3.4-6.i386.rpm
4534128db2230d8e8f0b76a591e7f7a6  i386/krb5-server-1.3.4-6.i386.rpm
c8f55dbadff7333fdb49b8f39173135b  i386/krb5-workstation-1.3.4-6.i386.rpm
0092eed09687bf677aa0ed0c3980ec98  i386/debug/krb5-debuginfo-1.3.4-6.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command. =20
---------------------------------------------------------------------


--8t9RHnE3ZwKMSgU+
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFBNMLJN5vOV3hoi/URAt+NAJ0RNTFGAgyp8PZ/52hVcxxM834PGACfbWLQ
WPH0I22vzvr+2Cfj8DII/T8=
=LHBF
-----END PGP SIGNATURE-----

--8t9RHnE3ZwKMSgU+--



--===============1926555165==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
fedora-announce-list mailing list
fedora-announce-list at redhat.com
http://www.redhat.com/mailman/listinfo/fedora-announce-list

--===============1926555165==--



More information about the UCI-Linux mailing list