SciLinux: CVE-2009-0846 Critical: krb5 Input Validation Flaw

Date: Tue, 7 Apr 2009 14:37:29 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: FASTBUGS for SL 5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

The following FASTBUGS have been uploaded to

 i386:
finch-2.5.5-1.el5.i386.rpm
finch-devel-2.5.5-1.el5.i386.rpm
gnome-python2-applet-2.16.0-3.el5.i386.rpm
gnome-python2-desktop-2.16.0-3.el5.i386.rpm
gnome-python2-gnomedesktop-2.16.0-3.el5.i386.rpm
gnome-python2-gnomekeyring-2.16.0-3.el5.i386.rpm
gnome-python2-gnomeprint-2.16.0-3.el5.i386.rpm
gnome-python2-gtksourceview-2.16.0-3.el5.i386.rpm
gnome-python2-libgtop2-2.16.0-3.el5.i386.rpm
gnome-python2-libwnck-2.16.0-3.el5.i386.rpm
gnome-python2-metacity-2.16.0-3.el5.i386.rpm
gnome-python2-nautilus-cd-burner-2.16.0-3.el5.i386.rpm
gnome-python2-rsvg-2.16.0-3.el5.i386.rpm
gnome-python2-totem-2.16.0-3.el5.i386.rpm
iproute-2.6.18-10.el5.i386.rpm
libpurple-2.5.5-1.el5.i386.rpm
libpurple-devel-2.5.5-1.el5.i386.rpm
libpurple-perl-2.5.5-1.el5.i386.rpm
libpurple-tcl-2.5.5-1.el5.i386.rpm
perl-5.8.8-18.el5_3.1.i386.rpm
perl-suidperl-5.8.8-18.el5_3.1.i386.rpm
pidgin-2.5.5-1.el5.i386.rpm
pidgin-devel-2.5.5-1.el5.i386.rpm
pidgin-perl-2.5.5-1.el5.i386.rpm
 x86_64:
finch-2.5.5-1.el5.i386.rpm
finch-2.5.5-1.el5.x86_64.rpm
finch-devel-2.5.5-1.el5.i386.rpm
finch-devel-2.5.5-1.el5.x86_64.rpm
gnome-python2-applet-2.16.0-3.el5.x86_64.rpm
gnome-python2-desktop-2.16.0-3.el5.x86_64.rpm
gnome-python2-gnomedesktop-2.16.0-3.el5.x86_64.rpm
gnome-python2-gnomekeyring-2.16.0-3.el5.x86_64.rpm
gnome-python2-gnomeprint-2.16.0-3.el5.x86_64.rpm
gnome-python2-gtksourceview-2.16.0-3.el5.x86_64.rpm
gnome-python2-libgtop2-2.16.0-3.el5.x86_64.rpm
gnome-python2-libwnck-2.16.0-3.el5.x86_64.rpm
gnome-python2-metacity-2.16.0-3.el5.x86_64.rpm
gnome-python2-nautilus-cd-burner-2.16.0-3.el5.x86_64.rpm
gnome-python2-rsvg-2.16.0-3.el5.x86_64.rpm
gnome-python2-totem-2.16.0-3.el5.x86_64.rpm
iproute-2.6.18-10.el5.x86_64.rpm
libpurple-2.5.5-1.el5.i386.rpm
libpurple-2.5.5-1.el5.x86_64.rpm
libpurple-devel-2.5.5-1.el5.i386.rpm
libpurple-devel-2.5.5-1.el5.x86_64.rpm
libpurple-perl-2.5.5-1.el5.x86_64.rpm
libpurple-tcl-2.5.5-1.el5.x86_64.rpm
perl-5.8.8-18.el5_3.1.x86_64.rpm
perl-suidperl-5.8.8-18.el5_3.1.x86_64.rpm
pidgin-2.5.5-1.el5.i386.rpm
pidgin-2.5.5-1.el5.x86_64.rpm
pidgin-devel-2.5.5-1.el5.i386.rpm
pidgin-devel-2.5.5-1.el5.x86_64.rpm
pidgin-perl-2.5.5-1.el5.x86_64.rpm

-Connie Sieh
-Troy Dawson
Date: Tue, 7 Apr 2009 14:54:00 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Critical: krb5 on SL3.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Critical: krb5 security update
Issue date:	2009-04-07
CVE Names:	CVE-2009-0846

An input validation flaw was found in the ASN.1 (Abstract Syntax
Notation One) decoder used by MIT Kerberos. A remote attacker could use
this flaw to crash a network service using the MIT Kerberos library,
such as kadmind or krb5kdc, by causing it to dereference or free an
uninitialized pointer or, possibly, execute arbitrary code with the
privileges of the user running the service. (CVE-2009-0846)

All running services using the MIT Kerberos libraries must be restarted
for the update to take effect.

SL 3.0.x

 SRPMS:
krb5-1.2.7-70.src.rpm
 i386:
krb5-devel-1.2.7-70.i386.rpm
krb5-libs-1.2.7-70.i386.rpm
krb5-server-1.2.7-70.i386.rpm
krb5-workstation-1.2.7-70.i386.rpm
 x86_64:
krb5-devel-1.2.7-70.x86_64.rpm
krb5-libs-1.2.7-70.i386.rpm
krb5-libs-1.2.7-70.x86_64.rpm
krb5-server-1.2.7-70.x86_64.rpm
krb5-workstation-1.2.7-70.x86_64.rpm

-Connie Sieh
-Troy Dawson