krb5 security update

2006-08-09T10:57:14
ID CESA-2006:0612
Type centos
Reporter CentOS Project
Modified 2006-08-10T17:30:56

Description

CentOS Errata and Security Advisory CESA-2006:0612

Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC.

A flaw was found where some bundled Kerberos-aware applications would fail to check the result of the setuid() call. On Linux 2.6 kernels, the setuid() call can fail if certain user limits are hit. A local attacker could manipulate their environment in such a way to get the applications to continue to run as root, potentially leading to an escalation of privileges. (CVE-2006-3083).

Users are advised to update to these erratum packages which contain a backported fix to correct this issue.

Merged security bulletin from advisories: http://lists.centos.org/pipermail/centos-announce/2006-August/013129.html http://lists.centos.org/pipermail/centos-announce/2006-August/013130.html http://lists.centos.org/pipermail/centos-announce/2006-August/013131.html http://lists.centos.org/pipermail/centos-announce/2006-August/013133.html http://lists.centos.org/pipermail/centos-announce/2006-August/013134.html

Affected packages: krb5 krb5-devel krb5-libs krb5-server krb5-workstation

Upstream details at: https://rhn.redhat.com/errata/RHSA-2006-0612.html