-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2012:111 http://www.mandriva.com/security/ _______________________________________________________________________ Package : krb5 Date : August 1, 2012 Affected: 2011., Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability has been discovered and corrected in krb5: The MIT krb5 KDC (Key Distribution Center) daemon can free an uninitialized pointer while processing an unusual AS-REQ, corrupting the process heap and possibly causing the daemon to abnormally terminate. An attacker could use this vulnerability to execute malicious code, but exploiting frees of uninitialized pointers to execute code is believed to be difficult. It is possible that a legitimate client that is misconfigured in an unusual way could trigger this vulnerability (CVE-2012-1015). The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1015 _______________________________________________________________________ Updated Packages: Mandriva Linux 2011: c97ac6f4bc0136d3d7e47a8328726b3b 2011/i586/krb5-1.9.1-1.4-mdv2011.0.i586.rpm d2aef21ae4f4e579a8717332aa13e20e 2011/i586/krb5-pkinit-openssl-1.9.1-1.4-mdv2011.0.i586.rpm f9380168b619b05c77c6d8b9aa7c581f 2011/i586/krb5-server-1.9.1-1.4-mdv2011.0.i586.rpm 69b4e94c345c9ed8ef3dd89e35e67164 2011/i586/krb5-server-ldap-1.9.1-1.4-mdv2011.0.i586.rpm effc40635d93060f82ac29cbc517414a 2011/i586/krb5-workstation-1.9.1-1.4-mdv2011.0.i586.rpm 7867ccdef0b0be42702e8560923c905d 2011/i586/libkrb53-1.9.1-1.4-mdv2011.0.i586.rpm 45bd32260bb048b10b609e6a83030225 2011/i586/libkrb53-devel-1.9.1-1.4-mdv2011.0.i586.rpm 4c288a562b56030e022dffc7f05cf085 2011/SRPMS/krb5-1.9.1-1.4.src.rpm Mandriva Linux 2011/X86_64: f39033dba0f8e17fb159a9defb0c1d30 2011/x86_64/krb5-1.9.1-1.4-mdv2011.0.x86_64.rpm 12c880bbe5ddc79d0198718cb9213af8 2011/x86_64/krb5-pkinit-openssl-1.9.1-1.4-mdv2011.0.x86_64.rpm 92da383bb2aba80cfa1b8c1711815b28 2011/x86_64/krb5-server-1.9.1-1.4-mdv2011.0.x86_64.rpm c9d3c5a836944fcd2618f8d2f39b9952 2011/x86_64/krb5-server-ldap-1.9.1-1.4-mdv2011.0.x86_64.rpm 70067964b4771220cc817312811761c7 2011/x86_64/krb5-workstation-1.9.1-1.4-mdv2011.0.x86_64.rpm 9b4a4a94492b1402e0703fe581268d4c 2011/x86_64/lib64krb53-1.9.1-1.4-mdv2011.0.x86_64.rpm 4ca7c65a9a93ddabf26302800531c43e 2011/x86_64/lib64krb53-devel-1.9.1-1.4-mdv2011.0.x86_64.rpm 4c288a562b56030e022dffc7f05cf085 2011/SRPMS/krb5-1.9.1-1.4.src.rpm Mandriva Enterprise Server 5: d2805127734cfc9fa44d63eb1dcdd069 mes5/i586/krb5-1.8.1-0.9mdvmes5.2.i586.rpm 1b64fce78bfad7e75d6e3a4a6a88c933 mes5/i586/krb5-pkinit-openssl-1.8.1-0.9mdvmes5.2.i586.rpm 21d0f0de422ef8d4c98fad788e06ba84 mes5/i586/krb5-server-1.8.1-0.9mdvmes5.2.i586.rpm e4ab86d99061868402ac91c846b8fd32 mes5/i586/krb5-server-ldap-1.8.1-0.9mdvmes5.2.i586.rpm f6dce68d50ac7cf9f94593cd71666e77 mes5/i586/krb5-workstation-1.8.1-0.9mdvmes5.2.i586.rpm 886fb345779a8ad2c9699cd0cd012cf8 mes5/i586/libkrb53-1.8.1-0.9mdvmes5.2.i586.rpm 20b58f868a943cdc5b824341e1cad72f mes5/i586/libkrb53-devel-1.8.1-0.9mdvmes5.2.i586.rpm c068435186c7e2c946260c5b4e656626 mes5/SRPMS/krb5-1.8.1-0.9mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: 1689053182459865f534fa50a3fd73cb mes5/x86_64/krb5-1.8.1-0.9mdvmes5.2.x86_64.rpm 190a1887fec26114c228a22fdc01a88b mes5/x86_64/krb5-pkinit-openssl-1.8.1-0.9mdvmes5.2.x86_64.rpm 6aa504edffa628c61ef34bf7bdfe260a mes5/x86_64/krb5-server-1.8.1-0.9mdvmes5.2.x86_64.rpm 3cdc1c5a9ed45f60331b0798457d5da7 mes5/x86_64/krb5-server-ldap-1.8.1-0.9mdvmes5.2.x86_64.rpm e0c16639fffaeb988454607edf5a8bee mes5/x86_64/krb5-workstation-1.8.1-0.9mdvmes5.2.x86_64.rpm 8701473a6a48616933c58af2a530a236 mes5/x86_64/lib64krb53-1.8.1-0.9mdvmes5.2.x86_64.rpm 8f1035e2b966c411a216c4ff8b704569 mes5/x86_64/lib64krb53-devel-1.8.1-0.9mdvmes5.2.x86_64.rpm c068435186c7e2c946260c5b4e656626 mes5/SRPMS/krb5-1.8.1-0.9mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) iD8DBQFQGTobmqjQ0CJFipgRArNeAKCJwFQu9r5jg03tyejfmyoUbQUBtACfYSjP ak0f4zXkaROgpdi2lIOr11c= =J2I9 -----END PGP SIGNATURE-----
