Scientific Linux SL5.x Moderate: pam_krb5 Privilege Escalation Fix

Date: Mon, 6 Oct 2008 15:27:27 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA for pam_krb5/krb5 on SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Moderate: pam_krb5/krb5 security update
Issue date:	2008-10-02
CVE Names:	CVE-2008-3825

pam_krb5 address the following security issue:

A flaw was found in the pam_krb5 "existing_ticket" configuration option. If
a system is configured to use an existing credential cache via the
"existing_ticket" option, it may be possible for a local user to gain
elevated privileges by using a different, local user's credential cache.
(CVE-2008-3825)

krb5 address the following bug:

* In cases where a server application began to sequentially iterate through
the contents of a keytab file, if it paused to call certain functions such
as krb5_rd_req() which encountered errors, a subsequent call to the
krb5_kt_next_entry() function could cause the calling application to crash.
The issue has been rectified and updated within these packages so that a
call to the krb5_kt_next_entry() function will not crash the calling
application.

SL 5.x

 SRPMS:
pam_krb5-2.2.14-1.el5_2.1.src.rpm
krb5-1.6.1-25.el5_2.1.src.rpm
 i386:
pam_krb5-2.2.14-1.el5_2.1.i386.rpm
krb5-devel-1.6.1-25.el5_2.1.i386.rpm
krb5-libs-1.6.1-25.el5_2.1.i386.rpm
krb5-server-1.6.1-25.el5_2.1.i386.rpm
krb5-workstation-1.6.1-25.el5_2.1.i386.rpm
 x86_64:
pam_krb5-2.2.14-1.el5_2.1.i386.rpm
pam_krb5-2.2.14-1.el5_2.1.x86_64.rpm
krb5-devel-1.6.1-25.el5_2.1.i386.rpm
krb5-devel-1.6.1-25.el5_2.1.x86_64.rpm
krb5-libs-1.6.1-25.el5_2.1.i386.rpm
krb5-libs-1.6.1-25.el5_2.1.x86_64.rpm
krb5-server-1.6.1-25.el5_2.1.x86_64.rpm
krb5-workstation-1.6.1-25.el5_2.1.x86_64.rpm

-Connie Sieh
-Troy Dawson