Advisories MDVSA-2009:098-1: krb5

[paul]

Multiple vulnerabilities has been found and corrected in krb5:

 

The get_input_token function in the SPNEGO implementation in MIT

Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to

cause a denial of service (daemon crash) and possibly obtain sensitive

information via a crafted length value that triggers a buffer over-read

(CVE-2009-0844).

 

The spnego_gss_accept_sec_context function in

lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5

through 1.6.3, when SPNEGO is used, allows remote attackers to cause

a denial of service (NULL pointer dereference and daemon crash) via

invalid ContextFlags data in the reqFlags field in a negTokenInit token

(CVE-2009-0845).

 

The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c in

the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5) before

1.6.4 allows remote attackers to cause a denial of service (daemon

crash) or possibly execute arbitrary code via vectors involving an

invalid DER encoding that triggers a free of an uninitialized pointer

(CVE-2009-0846).

 

The asn1buf_imbed function in the ASN.1 decoder in MIT Kerberos 5

(aka krb5) 1.6.3, when PK-INIT is used, allows remote attackers to

cause a denial of service (application crash) via a crafted length

value that triggers an erroneous malloc call, related to incorrect

calculations with pointer arithmetic (CVE-2009-0847).

 

The updated packages have been patched to correct these issues.

 

Update:

 

Packages for 2008.0 are being provided due to extended support for

Corporate products.