Stay Secure with the Latest Linux Advisories

security advisorygentooremote exploit

Gentoo: 200305-09 Critical Heimdal Kerberos Protocol Bug Remote Exploit

heimdal suffers from the same vulnerability as mit-krb5 does, hence the identical advisory.. - - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200305-09 - - - --------------------------------------------------------------------- PACKAGE : heimdal SUMMARY : protocol bug in the kerberos v4 cross-realm operation DATE : 2003-05-27 08:46 UTC EXPLOIT : remote VERSIONS AFFECTED : =heimdal-0.6 CVE : CAN-2003-0139 CAN-2003-0138 - - - --------------------------------------------------------------------- heimdal suffers from the same vulnerability as mit-krb5 does, hence the identical advisory. - - From advisory: "A cryptographic weakness in version 4 of the Kerberos protocol allows an attacker to use a chosen-plaintext attack to impersonate any principal in a realm. Additional cryptographic weaknesses in the krb4 implementation included in the MIT krb5 distribution permit the use of cut-and-paste attacks to fabricate krb4 tickets for unauthorized client principals if triple-DES keys are used to key krb4 services. These attacks can subvert a site's entire Kerberos authentication infrastructure." Read the full advisory at mit SOLUTION It is recommended that all Gentoo Linux users who are running app-crypt/heimdal upgrade to heimdal-0.6 as follows emerge sync emerge heimdal emerge clean - - - --------------------------------------------------------------------- This email address is being protected from spambots. You need JavaScript enabled to view it. - GnuPG key is available at - - - --------------------------------------------------------------------- . A critical flaw found in Heimdal's Kerberos version 4 poses risks for remote exploitation. Users of Gentoo are urged to update without delay.. Heimdal, Kerberos Protocol, Remote Exploit, Gentoo Security, Upgrade Recommendation. . Severity: Critical. LinuxSecurity.com Team

May 27, 2003 •Critical Gentoo