ELSA-2014-1389

ELSA-2014-1389 - krb5 security and bug fix update

Type:	SECURITY
Impact:	MODERATE
Release Date:	2014-10-15

Description

[1.10.3-33]
- actually apply that last patch

[1.10.3-32]
- incorporate fix for MITKRB5-SA-2014-001 (CVE-2014-4345, #1128157)

[1.10.3-31]
- ksu: when evaluating .k5users, don't throw away data from .k5users when we're
not passed a command to run, which implicitly means we're attempting to run
the target user's shell (#1026721, revised)

[1.10.3-30]
- ksu: when evaluating .k5users, treat lines with just a principal name as if
they contained the principal name followed by '*', and don't throw away data
from .k5users when we're not passed a command to run, which implicitly means
we're attempting to run the target user's shell (#1026721, revised)

[1.10.3-29]
- gssapi: pull in upstream fix for a possible NULL dereference in spnego
(CVE-2014-4344, #1121510)
- gssapi: pull in proposed-and-accepted fix for a double free in initiators
(David Woodhouse, CVE-2014-4343, #1121510)

[1.10.3-28]
- correct a type mistake in the backported fix for CVE-2013-1418/CVE-2013-6800

[1.10.3-27]
- pull in backported fix for denial of service by injection of malformed
GSSAPI tokens (CVE-2014-4341, CVE-2014-4342, #1121510)
- incorporate backported patch for remote crash of KDCs which serve multiple
realms simultaneously (RT#7756, CVE-2013-1418/CVE-2013-6800, more of

[1.10.3-26]
- pull in backport of patch to not subsequently always require that responses
come from master KDCs if we get one from a master somewhere along the way
while chasing referrals (RT#7650, #1113652)

[1.10.3-25]
- ksu: if the -e flag isn't used, use the target user's shell when checking
for authorization via the target user's .k5users file (#1026721)

[1.10.3-24]
- define _GNU_SOURCE in files where we use EAI_NODATA, to make sure that
it's declared (#1059730)

[1.10.3-23]
- spnego: pull in patch from master to restore preserving the OID of the
mechanism the initiator requested when we have multiple OIDs for the same
mechanism, so that we reply using the same mechanism OID and the initiator
doesn't get confused (#1087068, RT#7858)

[1.10.3-22]
- add patch from Jatin Nansi to avoid attempting to clear memory at the
NULL address if krb5_encrypt_helper() returns an error when called
from encrypt_credencpart() (#1055329, pull #158)

[1.10.3-21]
- drop patch to add additional access() checks to ksu - they shouldn't be
resulting in any benefit

[1.10.3-20]
- apply patch from Nikolai Kondrashov to pass a default realm set in
/etc/sysconfig/krb5kdc to the kdb_check_weak helper, so that it doesn't
produce an error if there isn't one set in krb5.conf (#1009389)

[1.10.3-19]
- packaging: don't Obsoletes: older versions of krb5-pkinit-openssl and
virtual Provide: krb5-pkinit-openssl on EL6, where we don't need to
bother with any of that (#1001961)

[1.10.3-18]
- pkinit: backport tweaks to avoid trying to call the prompter callback
when one isn't set (part of #965721)
- pkinit: backport the ability to use a prompter callback to prompt for
a password when reading private keys (the rest of #965721)

[1.10.3-17]
- backport fix to not spin on a short read when reading the length of a
response over TCP (RT#7508, #922884)

[1.10.3-16]
- backport fix for trying all compatible keys when not being strict about
acceptor names while reading AP-REQs (RT#7883, #1070244)

Related CVEs

CVE-2014-4343

CVE-2014-4342

CVE-2014-4341

CVE-2014-4345

CVE-2013-6800

CVE-2013-1418

CVE-2014-4344

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 6 (i386)	krb5-1.10.3-33.el6.src.rpm	082918646c4bfb30e040cb1ec82d75a3fa13bb5346652c49f7adf6193b193d67	ELSA-2016-0493	ol6_i386_latest_archive
	krb5-1.10.3-33.el6.src.rpm	082918646c4bfb30e040cb1ec82d75a3fa13bb5346652c49f7adf6193b193d67	ELSA-2016-0493	ol6_u6_i386_base
	krb5-devel-1.10.3-33.el6.i686.rpm	a7c0226e376342bb2cee4a9b93e91adfc4f171fe8b212805ca5574a0decdf1c3	ELSA-2016-0493	ol6_i386_latest_archive
	krb5-devel-1.10.3-33.el6.i686.rpm	a7c0226e376342bb2cee4a9b93e91adfc4f171fe8b212805ca5574a0decdf1c3	ELSA-2016-0493	ol6_u6_i386_base
	krb5-libs-1.10.3-33.el6.i686.rpm	24688cc451245fa6943020460c2cb195a543aaae067721a16f9956b66e8297c0	ELSA-2016-0493	ol6_i386_latest_archive
	krb5-libs-1.10.3-33.el6.i686.rpm	24688cc451245fa6943020460c2cb195a543aaae067721a16f9956b66e8297c0	ELSA-2016-0493	ol6_u6_i386_base
	krb5-pkinit-openssl-1.10.3-33.el6.i686.rpm	f67e798b3ec59ff638cc10ead1c3228c0647b015b77dd11bf2f1cb067c6e0818	ELSA-2016-0493	ol6_i386_latest_archive
	krb5-pkinit-openssl-1.10.3-33.el6.i686.rpm	f67e798b3ec59ff638cc10ead1c3228c0647b015b77dd11bf2f1cb067c6e0818	ELSA-2016-0493	ol6_u6_i386_base
	krb5-server-1.10.3-33.el6.i686.rpm	e3f6fc23d0466623ae438b7c3f599b09b1537b7deaaccf47fac240093c372348	ELSA-2016-0493	ol6_i386_latest_archive
	krb5-server-1.10.3-33.el6.i686.rpm	e3f6fc23d0466623ae438b7c3f599b09b1537b7deaaccf47fac240093c372348	ELSA-2016-0493	ol6_u6_i386_base
	krb5-server-ldap-1.10.3-33.el6.i686.rpm	1e730d2c2cf673bf2661912c0aec41546da334c5c1f775c1dd1d010568738841	ELSA-2016-0493	ol6_i386_latest_archive
	krb5-server-ldap-1.10.3-33.el6.i686.rpm	1e730d2c2cf673bf2661912c0aec41546da334c5c1f775c1dd1d010568738841	ELSA-2016-0493	ol6_u6_i386_base
	krb5-workstation-1.10.3-33.el6.i686.rpm	d8b396589979aa72aab37fe7ec026e2d029dfcf14d7c632cd13ac93ba826cb4a	ELSA-2016-0493	ol6_i386_latest_archive
	krb5-workstation-1.10.3-33.el6.i686.rpm	d8b396589979aa72aab37fe7ec026e2d029dfcf14d7c632cd13ac93ba826cb4a	ELSA-2016-0493	ol6_u6_i386_base
Oracle Linux 6 (x86_64)	krb5-1.10.3-33.el6.src.rpm	082918646c4bfb30e040cb1ec82d75a3fa13bb5346652c49f7adf6193b193d67	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-1.10.3-33.el6.src.rpm	082918646c4bfb30e040cb1ec82d75a3fa13bb5346652c49f7adf6193b193d67	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-devel-1.10.3-33.el6.i686.rpm	a7c0226e376342bb2cee4a9b93e91adfc4f171fe8b212805ca5574a0decdf1c3	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-devel-1.10.3-33.el6.i686.rpm	a7c0226e376342bb2cee4a9b93e91adfc4f171fe8b212805ca5574a0decdf1c3	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-devel-1.10.3-33.el6.x86_64.rpm	81d725bb7f719dee8e9a2d4f113fd092fefa2ac5044299167f0e2cd14196a0ed	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-devel-1.10.3-33.el6.x86_64.rpm	81d725bb7f719dee8e9a2d4f113fd092fefa2ac5044299167f0e2cd14196a0ed	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-libs-1.10.3-33.el6.i686.rpm	24688cc451245fa6943020460c2cb195a543aaae067721a16f9956b66e8297c0	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-libs-1.10.3-33.el6.i686.rpm	24688cc451245fa6943020460c2cb195a543aaae067721a16f9956b66e8297c0	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-libs-1.10.3-33.el6.x86_64.rpm	ea594eee61d3e0579087ac97df1ec8f84d49a9294bce74214442dfa6d97e13d9	ELSA-2016-0493	exadata_dbserver_12.1.2.1.0_x86_64_base
	krb5-libs-1.10.3-33.el6.x86_64.rpm	ea594eee61d3e0579087ac97df1ec8f84d49a9294bce74214442dfa6d97e13d9	ELSA-2016-0493	exadata_dbserver_12.1.2.1.1_x86_64_base
	krb5-libs-1.10.3-33.el6.x86_64.rpm	ea594eee61d3e0579087ac97df1ec8f84d49a9294bce74214442dfa6d97e13d9	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-libs-1.10.3-33.el6.x86_64.rpm	ea594eee61d3e0579087ac97df1ec8f84d49a9294bce74214442dfa6d97e13d9	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-pkinit-openssl-1.10.3-33.el6.x86_64.rpm	90388a3e5e380702c5414e6f9d9c849e7995ca629859f541fcf2d940a64bd846	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-pkinit-openssl-1.10.3-33.el6.x86_64.rpm	90388a3e5e380702c5414e6f9d9c849e7995ca629859f541fcf2d940a64bd846	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-server-1.10.3-33.el6.x86_64.rpm	5d467156b574ce1a1c64b3711f13110227de7da44d775a688de81524e88a4e72	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-server-1.10.3-33.el6.x86_64.rpm	5d467156b574ce1a1c64b3711f13110227de7da44d775a688de81524e88a4e72	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-server-ldap-1.10.3-33.el6.i686.rpm	1e730d2c2cf673bf2661912c0aec41546da334c5c1f775c1dd1d010568738841	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-server-ldap-1.10.3-33.el6.i686.rpm	1e730d2c2cf673bf2661912c0aec41546da334c5c1f775c1dd1d010568738841	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-server-ldap-1.10.3-33.el6.x86_64.rpm	dc0d03eac38b4e81a2ceca2c6d77fda8405defa3cb69b399115cb9ba5fb9a0a8	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-server-ldap-1.10.3-33.el6.x86_64.rpm	dc0d03eac38b4e81a2ceca2c6d77fda8405defa3cb69b399115cb9ba5fb9a0a8	ELSA-2016-0493	ol6_x86_64_latest_archive
	krb5-workstation-1.10.3-33.el6.x86_64.rpm	50e9a787dc7a30e21e3ae8dbad677ecc77e401610a1b8ca88eadc095c93133e1	ELSA-2016-0493	ol6_u6_x86_64_base
	krb5-workstation-1.10.3-33.el6.x86_64.rpm	50e9a787dc7a30e21e3ae8dbad677ecc77e401610a1b8ca88eadc095c93133e1	ELSA-2016-0493	ol6_x86_64_latest_archive

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team