Alerts This Week
Warning Icon 1 677
Alerts This Week
Warning Icon 1 677

openSUSE Leap 42.3 Critical Alert: Remote DoS Vulnerability in libheimdal

opensuse
Calendar Grey August 16, 2018
Dist Opensuse Esm H88
The latest libheimdal update addresses significant security vulnerabilities, resolving remote Denial-of-Service risks and improving overall software reliability.
An update that solves one vulnerability and has two fixes is now available.

Description

This update for libheimdal to version 7.5.0 fixes the following issues:

The following security vulnerability was fixed:

- CVE-2017-17439: Fixed a remote denial of service vulnerability through

which remote unauthenticated attackers were able to crash the KDC by

sending a crafted UDP packet containing empty data fields for client

name or realm (boo#1071675)

The following other bugs were fixed:

- Override the build date (boo#1047218)

- Use constant hostname (boo#1084909)

- Handle long input lines when reloading database dumps

- In pre-forked mode, correctly clear the process ids of exited children,

allowing new child processes to replace the old.

- Fixed incorrect KDC response when no-cross realm TGT exists, allowing

client requests to fail quickly rather than time out after trying to get

a correct answer from each KDC.

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-876=1

Package List

- openSUSE Leap 42.3 (i586 x86_64):

libheimdal-7.5.0-9.1

libheimdal-debuginfo-7.5.0-9.1

libheimdal-debugsource-7.5.0-9.1

libheimdal-devel-7.5.0-9.1

References

https://www.suse.com/security/cve/CVE-2017-17439.html

https://bugzilla.suse.com/1047218

https://bugzilla.suse.com/1071675

https://bugzilla.suse.com/1084909

--

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2018:2376-1
Rating: important
Affected Products: openSUSE Leap 42.3 le.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here