Gentoo Archives: gentoo-announce

From: Kurt Lieber <klieber@g.o>
To: gentoo-announce@l.g.o
Cc: bugtraq@×××××××××××××.com, full-disclosure@××××××××××××.com, security-alerts@×××××××××××××.com
Subject: [gentoo-announce] [ GLSA 200405-23 ] Heimdal: Kerberos 4 buffer overflow in kadmin
Date: Thu, 27 May 2004 12:27:01
Message-Id: 20040527122628.GH3228@mail.lieber.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 200405-23
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 http://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: High
8 Title: Heimdal: Kerberos 4 buffer overflow in kadmin
9 Date: May 27, 2004
10 Bugs: #50208
11 ID: 200405-23
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 A possible buffer overflow in the Kerberos 4 component of Heimdal has
19 been discovered.
20
21 Background
22 ==========
23
24 Heimdal is a free implementation of Kerberos.
25
26 Affected packages
27 =================
28
29 -------------------------------------------------------------------
30 Package / Vulnerable / Unaffected
31 -------------------------------------------------------------------
32 1 app-crypt/heimdal < 0.6.2 >= 0.6.2
33
34 Description
35 ===========
36
37 A buffer overflow was discovered in kadmind, a server for
38 administrative access to the Kerberos database.
39
40 Impact
41 ======
42
43 By sending a specially formatted message to kadmind, a remote attacker
44 may be able to crash kadmind causing a denial of service, or execute
45 arbitrary code with the permissions of the kadmind process.
46
47 Workaround
48 ==========
49
50 For a temporary workaround, providing you do not require Kerberos 4
51 support, you may turn off Kerberos 4 kadmin by running kadmind with the
52 --no-kerberos4 option.
53
54 Resolution
55 ==========
56
57 All Heimdal users should upgrade to the latest stable version:
58
59 # emerge sync
60
61 # emerge -pv ">=app-crypt/heimdal-0.6.2"
62 # emerge ">=app-crypt/heimdal-0.6.2"
63
64 References
65 ==========
66
67 [ 1 ] Heimdal 0.6.2 Release Notice
68 http://www.pdc.kth.se/heimdal/advisory/2004-05-06/
69 [ 2 ] CAN-2004-0434
70 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0434
71
72 Availability
73 ============
74
75 This GLSA and any updates to it are available for viewing at
76 the Gentoo Security Website:
77
78 http://security.gentoo.org/glsa/glsa-200405-23.xml
79
80 Concerns?
81 =========
82
83 Security is a primary focus of Gentoo Linux and ensuring the
84 confidentiality and security of our users machines is of utmost
85 importance to us. Any security concerns should be addressed to
86 security@g.o or alternatively, you may file a bug at
87 http://bugs.gentoo.org.
88
89 License
90 =======
91
92 Copyright 2004 Gentoo Technologies, Inc; referenced text
93 belongs to its owner(s).
94
95 The contents of this document are licensed under the
96 Creative Commons - Attribution / Share Alike license.
97
98 http://creativecommons.org/licenses/by-sa/1.0