| Description: | Description:
The remote host is missing an update to krb5
announced via advisory MDKSA-2004:056-1.
Multiple buffer overflows exist in the krb5_aname_to_localname()
library function that if exploited could lead to unauthorized root
privileges. In order to exploit this flaw, an attacker must first
successfully authenticate to a vulnerable service, which must be
configured to enable the explicit mapping or rules-based mapping
functionality of krb5_aname_to_localname, which is not a default
configuration.
Mandrakesoft encourages all users to upgrade to these patched krb5
packages.
Update:
The original patch provided contained a bug where rule-based entries
on systems without HAVE_REGCOMP would not work. These updated
packages provide the second patch provided by Kerberos development
team which fixes that behaviour.
Affected versions: 10.0, 9.1, 9.2, Corporate Server 2.1,
Multi Network Firewall 8.2
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDKSA-2004:056-1
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0523
http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2004-001-an_to_ln.txt
Risk factor : Critical
CVSS Score:
10.0
|
