-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2010-4608 2010-03-16 23:01:22 --------------------------------------------------------------------------------
Name : krb5 Product : Fedora 13 Version : 1.7.1 Release : 7.fc13 URL : http://web.mit.edu/kerberos/www/ Summary : The Kerberos network authentication system Description : Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of cleartext passwords. -------------------------------------------------------------------------------- Update Information: A GSSAPI-authenticated service could be remotely forced to trigger an assertion failure by sending it certain invalid messages (MITKRB5-SA-2010-002, CVE-2010-0628). The included patch for adding PAM support to the bundled FTP server contained a bug which would cause the service to crash if a client attempted to authenticate as a user who was not known to the server system. In the default xinetd configuration, the service would be invoked with the -a flag, and this would therefore only be possible if the client authenticated using GSSAPI beforehand. -------------------------------------------------------------------------------- References: [ 1 ] Bug #566258 - CVE-2010-0628 krb5: Assertion failure in GSSAPI SPNEGO mechanism (MITKRB5-SA-2010-002) https://bugzilla.redhat.com/show_bug.cgi?id=566258 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update krb5' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/package-announce
