Fedora 7 : krb5-1.6.1-3.fc7 (2007-2017)

This update incorporates fixes for a stack overflow in the rpcsecgss implementation in libgssrpc CVE-2007-3999 and a potential write through an uninitialized pointer in kadmind CVE-2007-4000. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora...

Fedora 7 : krb5-1.6.1-4.fc7 (2007-2066)

The originally-used patch for CVE-2007-3999 didn't completely fix the bug. This update includes the revised patch. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format i...

openSUSE 10 Security Update : krb5 (krb5-3045)

A bug in the function krb5klogsyslog leads to a buffer overflow which could be exploited to execute arbitrary code CVE-2007-0957. A double-free bug in the GSS-API library could crash kadmind. It's potentially also exploitable to execute arbitrary code CVE-2007-1216. %NASLMINLEVEL 70300 C Tenable...

openSUSE 10 Security Update : krb5 (krb5-4191)

This update of krb5 fixes two bugs in kadmind that can be used to execute arbitrary code remotely. CVE-2007-3999, CVE-2007-4000 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update krb5-4191. The...

openSUSE 10 Security Update : krb5 (krb5-4248)

This update improves the patch for the previously released security update of krb5 to fix CVE-2007-3999 and CVE-2007-4000. CVE-2007-4743 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

openSUSE 10 Security Update : krb5-apps-clients (krb5-apps-clients-1937)

Various return checks of setuid and seteuid calls have been fixed in kerberos client and server applications. If these applications are setuid, it might have been possible for local attackers to gain root access CVE-2006-3083. We are not affected by the seteuid problems, tracked by CVE-2006-3084...

openSUSE 10 Security Update : krb5 (krb5-3820)

This update fixes a stack-based buffer overflow in kadmind which can be exploited by authenticated remote users to gain root. CVE-2007-2798 Additionally two bugs in the RPC library of kadmind were fixed that can lead to remote system compromise. CVE-2007-2442, CVE-2007-2443 Note that third-party...

openSUSE 10 Security Update : samba (samba-2584)

"A logic error in the deferred open code can lead to an infinite loop in Samba's smbd daemon. In addition the following changes are included with these packages : - Disable broken DCERPC funnel patch; 242833. - Avoid winbind event handler for internal domains. - Fix smbcontrol winbind offline;...

openSUSE 10 Security Update : krb5 (krb5-2442)

Bugs in the handling of pointers to uninitializes resp. already freed memory could potentially be abused by attackers to execute code CVE-2006-6144, CVE-2006-6143. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

openSUSE 10 Security Update : krb5-apps-servers (krb5-apps-servers-3021)

When using the krb5 telnet daemon it was possible for remote attackers to override authentication mechanisms and gain root access to the machine by supplying a special username. This is tracked by the Mitre CVE ID CVE-2007-0956. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

HP-UX Security Patch : PHSS_34990

KRB5-Client Version 1.0 cumulative patch %NASLMINLEVEL 70300 C Tenable Network Security, Inc. if !definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid26847; scriptversion"1.8"; scriptsetattributeattribute:"pluginmodificationdate",...

SUSE-SA:2007:038: krb5

The remote host is missing the patch for the advisory SUSE-SA:2007:038 krb5. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This plugin text was extracted from SuSE Security Advisory SUSE-SA:2007:038 if ! definedfunc"bnrandom" exit0; include'deprecatednasllevel.inc'; include'compat.inc';...

VMSA-2007-0006:Updated versions of all supported hosted products and all ESX 2x products and patches for ESX 30x address CRITICAL security updates. Service Console security updates for samba, bind, krb5, vixie-cron, shadow-utils, openldap, pam, gcc, and gdb packages.

VMSA-2007-0006 Updated versions of all supported hosted products and all ESX 2x products and patches for ESX 30x address critical security updates. Service Console security updates for samba, bind, krb5, vixie-cron, shadow-utils, openldap, pam, gcc, and gdb packages. VMware Security Advisory VMwa...

Fedora Core 6 : krb5-1.5-23.fc6 (2007-694)

The originally-used patch for CVE-2007-3999 didn't completely fix the bug. This update includes the revised patch. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format i...

RHEL 5 : krb5 (RHSA-2007:0892)

Updated krb5 packages that correct a security flaw are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and servers to authenticate t...

[SECURITY] Fedora Core 6 Update: krb5-1.5-23.fc6

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of cleartext passwords...

krb5 incomplete fix for CVE-2007-3999

The original patch for CVE-2007-3999 in svcauthgss.c in the RPCSECGSS RPC library in MIT Kerberos 5 krb5 1.4 through 1.6.2, as used by the Kerberos administration daemon kadmind and other applications that use krb5, does not correctly check the buffer length in some environments and architectures...

Important: Red Hat Security Advisory: krb5 security update

Updated krb5 packages that correct a security flaw are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. Kerberos is a network authentication system which allows clients and servers to authenticate t...

Important: krb5 security update

1.5-29 - update to revised patch for CVE-2007-3999...

CVE-2007-4743

The CVE-2007-4743 entry concerns MIT Kerberos 5 (krb5) RPCSEC_GSS: in versions 1.4 through 1.6.2, the patch for CVE-2007-3999 does not properly check buffer lengths in svc_auth_gss.c, which may allow a remote attacker to trigger a buffer overflow. Affected components include krb5’s RPC library us...