- ------------------------------------------------------------------------
Debian Security Advisory DSA-2129-1                  security@debian.org
http://www.debian.org/security/                           Stefan Fritsch
December 1, 2010                      http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : krb5
Vulnerability  : checksum verification weakness
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2010-1323

A vulnerability has been found in krb5, the MIT implementation of
Kerberos.

MIT krb5 clients incorrectly accept an unkeyed checksums in the SAM-2
preauthentication challenge: An unauthenticated remote attacker could
alter a SAM-2 challenge, affecting the prompt text seen by the user or
the kind of response sent to the KDC. Under some circumstances, this
can negate the incremental security benefit of using a single-use
authentication mechanism token.

MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums using
RC4 keys when verifying KRB-SAFE messages: An unauthenticated remote
attacker has a 1/256 chance of forging KRB-SAFE messages in an
application protocol if the targeted pre-existing session uses an RC4
session key. Few application protocols use KRB-SAFE messages.

The Common Vulnerabilities and Exposures project has assigned
CVE-2010-1323 to these issues.

For the stable distribution (lenny), these problems have been fixed in
version 1.6.dfsg.4~beta1-5lenny6.

The builds for the mips architecture are not included in this advisory.
They will be released as soon as they are available.

For the testing distribution (squeeze) and the unstable distribution
(sid), these problem have been fixed in version 1.8.3+dfsg-3.

We recommend that you upgrade your krb5 packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny (stable)
- -----------------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mipsel, powerpc, s390 and sparc.

Source archives:

      Size/MD5 checksum:     1537 6f0899080bda14e0a277120d9395a707
      Size/MD5 checksum:   850645 fe444178e83d0010636cf3c50129a437
      Size/MD5 checksum: 11647547 08d6ce311204803acbe878ef0bb23c71

Architecture independent packages:

      Size/MD5 checksum:  2147158 2cfbb257055a479cfd20c28ac036841a

alpha architecture (DEC Alpha)

      Size/MD5 checksum:    83438 ef4ea5d711704df27427ff9f31adf0ea
      Size/MD5 checksum:    72510 006248eab3a97b16f58672cd071ad364
      Size/MD5 checksum:   150098 2d6b0db75b4fb0cbaf9f35ae3222418a
      Size/MD5 checksum:    93104 063e77172ad83b511cec94744897774a
      Size/MD5 checksum:   179996 1308d85575bc72553091415ddf495f1d
      Size/MD5 checksum:    70572 e344d6c4b97d5cb687c545a8c23bd509
      Size/MD5 checksum:   538936 53fa646ff8cd2cbfeaedec1f163658a0
      Size/MD5 checksum:    98862 54f5ec1148fd23369ad3939668ebf354
      Size/MD5 checksum:  1352374 008f7018c0f89e6a4a65efceb6670ffe
      Size/MD5 checksum:   219658 01d18db8606f3b0df1e573663bfa3304
      Size/MD5 checksum:   113144 9d90e615677c2e53902e85465cbd8765
      Size/MD5 checksum:   255778 75c8eef8f51aeae3fe00e861a369958b
      Size/MD5 checksum:    98788 780c1bcf6bccd01c5ab309be264917cc

amd64 architecture (AMD x86_64 (AMD64))

      Size/MD5 checksum:   199668 205aee381d50d20e538e13c399269b24
      Size/MD5 checksum:   238594 093eb931610c5e4dd7a85f64782c1aab
      Size/MD5 checksum:  1474680 6410656466c3300e86ed0c319c48f3b5
      Size/MD5 checksum:    68234 0f4adafd1029f012d8f1048bc76e2c69
      Size/MD5 checksum:   108488 f173adaf924918436a1923f83cad2694
      Size/MD5 checksum:   519714 2b3e3ba20811e361a01428945c7af509
      Size/MD5 checksum:   147192 aa391b6dc07005aefa2185211e57d095
      Size/MD5 checksum:    94296 7dd3e04aca1d7c332a466d1e97b0d72d
      Size/MD5 checksum:    68972 6f60567e22ae41f054329fdf338f89ae
      Size/MD5 checksum:    93680 099fcc98dd4c1e761ec863572a751e7d
      Size/MD5 checksum:   169486 acdccf6feb7dedd595bfc12ad892fa66
      Size/MD5 checksum:    77118 c9cae89896b869689e3a96257ec6a93e
      Size/MD5 checksum:    95304 5152166765688f5a6cf194c92f640df3

arm architecture (ARM)

      Size/MD5 checksum:    60962 78de95ae8bcfc091d1c86fe959436fbe
      Size/MD5 checksum:   145822 3019f82d0fb83200296d6c56a31a2738
      Size/MD5 checksum:    65632 35d0e0fb2f05640a5a09c213929f163d
      Size/MD5 checksum:  1283282 63ba90efe2200d804e1f1f5ea2dad6bd
      Size/MD5 checksum:    87398 2f0a3dbed0a63b1c4512adfb98db2067
      Size/MD5 checksum:    91650 dffa38de9c76d431f8f4705f4d3f2c48
      Size/MD5 checksum:    86736 1707f506ac462a739acf8cc723bfc443
      Size/MD5 checksum:   102412 38bfb425ef261cab3dc2c69e329e5b72
      Size/MD5 checksum:    69728 2ece460488226c07c43a845c0444de81
      Size/MD5 checksum:   449956 c105addd63b71be6d619b4789c850d72
      Size/MD5 checksum:   187862 72a7a81936a350777c4f586ace0c8ddb
      Size/MD5 checksum:   135900 f425d1b6c1f88a54f5476f9a4802db0b
      Size/MD5 checksum:   206446 cc1815c08f3a809d6a713cb35aecc69f

armel architecture (ARM EABI)

      Size/MD5 checksum:    86204 fbd761e91a724d3f007ed744e0011ddb
      Size/MD5 checksum:    69856 b31394de93feb7c1992c8f108953f442
      Size/MD5 checksum:   185384 1574b680a4c4a179b398274e5af28d06
      Size/MD5 checksum:  1290338 8c3cfe5bf5c0d3f3900a4ba33b43a1bb
      Size/MD5 checksum:   145336 3f32d369a693c310a2b2e61a3d0e8eb2
      Size/MD5 checksum:   211892 5de75504f3786dd9c7e060a808f93c4c
      Size/MD5 checksum:   101424 b0e2e4b9edb3bda171828b60fa698c88
      Size/MD5 checksum:   135224 c4a0d84848e75f120479f848860a33de
      Size/MD5 checksum:    61072 9152b04572a1d12de3c992e52b220127
      Size/MD5 checksum:    93248 07e26be26cda15a500278d8383b7459d
      Size/MD5 checksum:    65364 317d7d81253df218c13b7ad0c1bc1531
      Size/MD5 checksum:    86768 24aec029e6c3e34e49bd3ef7a672d78f
      Size/MD5 checksum:   447908 83599c10d010cf92f35f268e44b6bc64

hppa architecture (HP PA RISC)

      Size/MD5 checksum:   144494 4a0b394104d101ca4640f4f910829f3d
      Size/MD5 checksum:    94348 4e0c05364b133142c22dc0b447dd61cd
      Size/MD5 checksum:    70196 a2f724fa7c6cee9824b216d94a4a0158
      Size/MD5 checksum:    69960 9cb3f9a0ebf87403a85fd06b605829cc
      Size/MD5 checksum:    93510 e2323d9162190b5cc9482782572d4c7d
      Size/MD5 checksum:   512884 76b77e34462f0ac80516cf80064a5c99
      Size/MD5 checksum:   171358 b219ced3d5b3093cea8bcfcfeec982ab
      Size/MD5 checksum:   110468 2cf1197c2252d6cac76273ee3df0b01e
      Size/MD5 checksum:    76872 6ed4eb3394e97a10a8e6098e273dac7d
      Size/MD5 checksum:    93560 95069b1916abf512f15826c503ce6612
      Size/MD5 checksum:   201238 d6f1eef60cc536f870665c6ea2af7f91
      Size/MD5 checksum:  1305576 dc9f1028401bd83781db6e6c31eaa6f6
      Size/MD5 checksum:   235290 dc3a451b8c33997004d9878ca5eb878a

i386 architecture (Intel ia32)

      Size/MD5 checksum:   214452 738e8a393925a78cf3fa4b4152373a16
      Size/MD5 checksum:  1415368 a4598be6685cd24f21ef44f48b09efbc
      Size/MD5 checksum:   187626 92e2de91f8464689475f670288567a14
      Size/MD5 checksum:    88020 5ecebac43535df0d9df407d54c325a09
      Size/MD5 checksum:    71322 31b9dbe9ecfbf411f146de1da7a8f125
      Size/MD5 checksum:   103108 3f4e8db534b71365d7e37a452ab789c7
      Size/MD5 checksum:    92288 83aa07d025154f5bc95b5f4192d5f71b
      Size/MD5 checksum:   135480 7fb584d49bbc645596adcc40b45d0504
      Size/MD5 checksum:    66584 8b3be11d78b846d9fd4597a29527f682
      Size/MD5 checksum:    87358 4a0d3c20363feac1dab30797dc43d805
      Size/MD5 checksum:    65434 ac3bfea2c4de893d40708450c3922e48
      Size/MD5 checksum:   480376 1b54c6218855debf2cf2b815d9f21af2
      Size/MD5 checksum:   154656 d627b36b078d37ce2619d8d3d7560f18

ia64 architecture (Intel ia64)

      Size/MD5 checksum:   219892 87c96266bcc423c997482e8773f8c65c
      Size/MD5 checksum:   312642 7ca2b0ebc9881b5acb78af45f3ffbef8
      Size/MD5 checksum:   271112 b45060574fe4b85d2642109ffcec4764
      Size/MD5 checksum:   701668 cfa44e532d38ea9e98480046bf52cd47
      Size/MD5 checksum:   114074 bb0fb3f1e915e31ba293e0f294d226f7
      Size/MD5 checksum:    93090 5ed61e60f92c6056369bd8f5806fcf98
      Size/MD5 checksum:   118856 a95178fd98e940789cee1b44d3cb2b82
      Size/MD5 checksum:   139358 1a61f65f55fec549bb804e706b3fc8a8
      Size/MD5 checksum:  1283710 ae2fab7815677f0fe3b9ce0f9605e158
      Size/MD5 checksum:    97926 59018641d2240904775bd4e14659af6f
      Size/MD5 checksum:   177706 47edf9284e84a66f3af6ddf990c5f12b
      Size/MD5 checksum:    85716 72c79658cf384223ffa9fcd2ef60e36a
      Size/MD5 checksum:    86090 f565730bdd7ee87f48fc50ca25cae5c3

mipsel architecture (MIPS (Little Endian))

      Size/MD5 checksum:    77306 de81fb54a73dbfe0319dbca1ecd57724
      Size/MD5 checksum:    69330 9883d37108a16d928c76e13d15e751d6
      Size/MD5 checksum:   142702 31544fc46b3986fe3c4aa09b1a672810
      Size/MD5 checksum:    93116 449aa3e82720a01fbc54b6161694f069
      Size/MD5 checksum:   103190 b57b4d9eab321b471f901f64068bd088
      Size/MD5 checksum:    64324 9b85a9d3aa9db68197164da735a2342f
      Size/MD5 checksum:  1355246 71dc1b288267260e383bd10a24d32c97
      Size/MD5 checksum:   236774 ea8cdbb968dd4617196128214e5eb722
      Size/MD5 checksum:   195152 24d68eb8d97600ab1ee1c1be32c3fc6e
      Size/MD5 checksum:    90396 f98800fec398247d95cc53674c584861
      Size/MD5 checksum:    92834 ecb8be5b35484ad4227f63d6eddfb157
      Size/MD5 checksum:   153052 73ab4d2e9c2b5ab1f54f1ebb651fb63d
      Size/MD5 checksum:   458840 7d5ab98636d4c9d8c1a3825776060ba8

powerpc architecture (PowerPC)

      Size/MD5 checksum:   164870 e7eefecd37a09ca4e1649b4e16d9ea0d
      Size/MD5 checksum:  1349228 781dd1b6ea140c194a413d816dd71df3
      Size/MD5 checksum:   248760 501bc73049844f47d045c9fd96a6033c
      Size/MD5 checksum:   100272 f74bdaf6136f23982c8b4f5ac13ed83a
      Size/MD5 checksum:    71456 385044cdcd93159f0301c3e0fc914b76
      Size/MD5 checksum:   208714 a68d811f0ee307844ed1c9f51e17900b
      Size/MD5 checksum:    93474 0c393f7d1eca5668424c29ed1dc6ce6a
      Size/MD5 checksum:   161506 4194db65de8937061153ff8bc7c8fe13
      Size/MD5 checksum:   502088 1b8115b0443258832eddacf54232b3c2
      Size/MD5 checksum:   102612 27e8db4c6e96124b78cc9ae987d6750f
      Size/MD5 checksum:    67910 f66715fecca27b0743645dfe1bb16da8
      Size/MD5 checksum:    78390 82c95ff77bb998b411435c1549754620
      Size/MD5 checksum:   112112 cdf4f547c3c5e459ca06a1015413e402

s390 architecture (IBM S/390)

      Size/MD5 checksum:    70782 73b1e1f7a6e41f14fb17fcd88eb16424
      Size/MD5 checksum:   170652 50c3a61cf7bd1c6a167217b62549b628
      Size/MD5 checksum:   516886 844d14b3f6c6259f521200f1cb3af61b
      Size/MD5 checksum:    69156 4099a96745e7967ee6b0c96a2f85851e
      Size/MD5 checksum:    93076 f4d0472c071dfabc449d4dddc374465f
      Size/MD5 checksum:   145296 ae32a498a7d4f72b2b9ace187beca983
      Size/MD5 checksum:   108878 9d66c42841eadd067477b43522e22161
      Size/MD5 checksum:    77524 04b2c4c8acf494db1805d7ecce77b0db
      Size/MD5 checksum:   200324 82567c38114447e76582d27bdcc52a73
      Size/MD5 checksum:  1366600 523d2ac199c522d5698a552dab95459a
      Size/MD5 checksum:    97424 00da8767f677fb4cce33da81ef9a0b70
      Size/MD5 checksum:    93180 7c6448d64e1a842ac997580bd4aaf688
      Size/MD5 checksum:   237898 ba3100dd00c70fcfed1ac53a08086da8

sparc architecture (Sun SPARC/UltraSPARC)

      Size/MD5 checksum:    87600 ee31e88c944732653ace1ebd1a612c6d
      Size/MD5 checksum:  1214700 278fc0a0289169673dc6e826bde00690
      Size/MD5 checksum:   183538 3338dc4739416094561617122231b593
      Size/MD5 checksum:   101072 b8aeb91d3240e39b062be867531fc8c9
      Size/MD5 checksum:   137240 c525df67d696cfa9ed9fdd65d678ddd1
      Size/MD5 checksum:    92996 83bb54ee1df3517aa48590d71f62b1c4
      Size/MD5 checksum:    66216 b597c60860b8070441b40af56dd1fab2
      Size/MD5 checksum:    88034 99403128da49c49bcaf0bcbd15145f52
      Size/MD5 checksum:   436990 990bc80762c2c908888285074673f2bb
      Size/MD5 checksum:    61780 85b4c6024d686a31469e40de59798508
      Size/MD5 checksum:   146822 55bc1e7be9a2dbb6336e904e315341e9
      Size/MD5 checksum:    72612 bd30e5706d49ddd17a31d1020c4c2345
      Size/MD5 checksum:   220016 11001e455ebcd15e88820eb823dbd97e


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp:  dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/