Lucene search

K
centosCentOS ProjectCESA-2010:0029
HistoryJan 13, 2010 - 12:51 a.m.

krb5 security update

2010-01-1300:51:06
CentOS Project
lists.centos.org
43

7 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.121 Low

EPSS

Percentile

95.2%

CentOS Errata and Security Advisory CESA-2010:0029

Kerberos is a network authentication system which allows clients and
servers to authenticate to each other using symmetric encryption and a
trusted third party, the Key Distribution Center (KDC).

Multiple integer underflow flaws, leading to heap-based corruption, were
found in the way the MIT Kerberos Key Distribution Center (KDC) decrypted
ciphertexts encrypted with the Advanced Encryption Standard (AES) and
ARCFOUR (RC4) encryption algorithms. If a remote KDC client were able to
provide a specially-crafted AES- or RC4-encrypted ciphertext or texts, it
could potentially lead to either a denial of service of the central KDC
(KDC crash or abort upon processing the crafted ciphertext), or arbitrary
code execution with the privileges of the KDC (i.e., root privileges).
(CVE-2009-4212)

All krb5 users should upgrade to these updated packages, which contain a
backported patch to correct these issues. All running services using the
MIT Kerberos libraries must be restarted for the update to take effect.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2010-January/078603.html
https://lists.centos.org/pipermail/centos-announce/2010-January/078604.html
https://lists.centos.org/pipermail/centos-announce/2010-January/078615.html
https://lists.centos.org/pipermail/centos-announce/2010-January/078616.html
https://lists.centos.org/pipermail/centos-announce/2010-January/078617.html
https://lists.centos.org/pipermail/centos-announce/2010-January/078618.html

Affected packages:
krb5-devel
krb5-libs
krb5-server
krb5-workstation

Upstream details at:
https://access.redhat.com/errata/RHSA-2010:0029

7 High

AI Score

Confidence

High

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.121 Low

EPSS

Percentile

95.2%

Related for CESA-2010:0029