Bugtraqmailing list archives

By Date

By Thread

[ GLSA 200501-05 ] mit-krb5: Heap overflow in libkadm5srv

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 200501-05- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  Severity: High     Title: mit-krb5: Heap overflow in libkadm5srv      Date: January 05, 2005      Bugs: #75143        ID: 200501-05- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========The MIT Kerberos 5 administration library (libkadm5srv) contains a heapoverflow that could lead to execution of arbitrary code.Background==========MIT krb5 is the free implementation of the Kerberos networkauthentication protocol by the Massachusetts Institute of Technology.Affected packages=================    -------------------------------------------------------------------     Package             /  Vulnerable  /                   Unaffected    -------------------------------------------------------------------  1  app-crypt/mit-krb5       < 1.3.6                         >= 1.3.6Description===========The MIT Kerberos 5 administration library libkadm5srv contains a heapoverflow in the code handling password changing.Impact======Under specific circumstances an attacker could execute arbitary codewith the permissions of the user running mit-krb5, which could be theroot user.Workaround==========There is no known workaround at this time.Resolution==========All mit-krb5 users should upgrade to the latest version:    # emerge --sync    # emerge --ask --oneshot --verbose ">=app-crypt/mit-krb5-1.3.6"References==========  [ 1 ] CAN 2004-1189http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1189Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:http://security.gentoo.org/glsa/glsa-200501-05.xmlConcerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity () gentoo org or alternatively, you may file a bug athttp://bugs.gentoo.org.License=======Copyright 2005 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.http://creativecommons.org/licenses/by-sa/2.0

Attachment:_bin
Description:

By Date

By Thread

Current thread:

• [ GLSA 200501-05 ] mit-krb5: Heap overflow in libkadm5srvSune Kloppenborg Jeppesen (Jan 05)