| Descripción: | Description:
The remote host is missing an update to heimdal
announced via advisory MDVSA-2010:129.
Multiple vulnerabilities has been found and corrected in heimdal:
The (1) krshd and (2) v4rcp applications in (a) MIT Kerberos 5 (krb5)
up to 1.5, and 1.4.x before 1.4.4, when running on Linux and AIX, and
(b) Heimdal 0.7.2 and earlier, do not check return codes for setuid
calls, which allows local users to gain privileges by causing setuid
to fail to drop privileges using attacks such as resource exhaustion
(CVE-2006-3083).
The (1) ftpd and (2) ksu programs in (a) MIT Kerberos 5 (krb5) up to
1.5, and 1.4.x before 1.4.4, and (b) Heimdal 0.7.2 and earlier, do not
check return codes for setuid calls, which might allow local users to
gain privileges by causing setuid to fail to drop privileges. NOTE:
as of 20060808, it is not known whether an exploitable attack scenario
exists for these issues (CVE-2006-3084).
Certain invalid GSS-API tokens can cause a GSS-API acceptor (server)
to crash due to a null pointer dereference in the GSS-API library
(CVE-2010-1321).
The updated packages have been patched to correct these issues.
Affected: Corporate 4.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2010:129
http://www.h5l.org/advisories.html?show=2006-08-08
http://www.h5l.org/advisories.html?show=2010-05-27
Risk factor : High
CVSS Score:
7.2
|
