Red Hat Enterprise IPA主Kerberos密码信息泄漏漏洞

BUGTRAQ ID: 31111 CVE ID：CVE-2008-3274 CNCVE ID：CNCVE-20082358 Red Hat Enterprise IPA是一款提供集中管理识别，策略和审核的集成方案。 Red Hat Enterprise IPA安装过程存在缺陷，远程攻击者可以利用漏洞获得主kerberos密码信息。 攻击者通过匿名LDAP连接可以获得此密码信息。 注：主kerberos密码用于加密密钥，此缺陷不会导致个体密钥泄漏。 RedHat Enterprise IPA 1 for RHEL 5 Server Red Hat可参考如下补丁程序： Red Hat...

CVE-2008-3274

The default configuration of Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1 places ldap:///anyone on the read ACL for the krbMKey attribute, which allows remote attackers to obtain the Kerberos master key via an anonymous LDAP query...

CVE-2008-3274

The CVE-2008-3274 issue affects Red Hat Enterprise IPA 1.0.0 and FreeIPA before 1.1.1, where the default LDAP ACLs expose the krbMKey attribute to ldap:///anyone, allowing anonymous LDAP queries to leak the Kerberos master key. This is a read ACL misconfiguration that can impact confidentiality (...

Fedora 8 : ipa-1.1.0-4.fc8 (2008-7987)

Security update to address Kerberos master password disclosure flaw CVE-2008-3274. A simple update is not sufficient to resolve the security issue. Please carefully follow the upgrade instructions at: http://freeipa.org/page/CVE-2008-3274 Note that Tenable Network Security has extracted the...

Important: Red Hat Security Advisory: ipa security update

Updated ipa packages that fix a security flaw are now available for Red Hat Enterprise IPA. This update has been rated as having important security impact by the Red Hat Security Response Team. Red Hat Enterprise IPA is an integrated solution to provide centrally-managed Identity machines, users,...

Security fix for the ALT Linux 8 package freeipa version 1.1.0-3

July 23, 2008 Simo Sorce &[email protected] - 1.1.0-3 - Fix for CVE-2008-3274 - Fix segfault in ipa-kpasswd in case getifaddrs returns a NULL interface - Add fix for bug 453185 - Rebuild against openldap libraries, mozldap ones do not work properly - TurboGears is currently broken in rawhide...

CVE-2007-3274

CVE-2007-3274 affects Apple Safari 3.0 and 3.0.1 on Windows XP SP2. The vulnerability arises when JavaScript sets the document.location variable, with attackers able to trigger a denial of service (application crash) as demonstrated by an empty value of document.location. The connected documents ...

CVE-2006-3274

CVE-2006-3274 : Webmin

[Full-disclosure] MDKSA-2005:235 - Updated kernel packages fix numerous vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDKSA-2005:235 http://www.mandriva.com/security/ Package : kernel Date : December 21, 2005 Affected: 2006.0 Problem Description: Multiple vulnerabilities in the Linux 2.6 kernel have been discovered and corrected in th...

[SECURITY] [DSA 922-1] New Linux 2.6.8 packages fix several vulnerabilities

-------------------------------------------------------------------------- Debian Security Advisory DSA 922-1 [email protected] http://www.debian.org/security/ Martin Schulze December 14th, 2005 http://www.debian.org/security/faq -...

CVE-2005-3274

Race condition in ipvsconnflush in Linux 2.6 before 2.6.13 and 2.4 before 2.4.32-pre2, when running on SMP systems, allows local users to cause a denial of service null dereference by causing a connection timer to expire while the connection table is being flushed before the appropriate lock is...