| Description: | Description:
The remote host is missing updates announced in
advisory RHSA-2005:012.
Kerberos is a networked authentication system that uses a trusted third
party (a KDC) to authenticate clients and servers to each other.
A heap based buffer overflow bug was found in the administration library of
Kerberos 1.3.5 and earlier. This bug could allow an authenticated remote
attacker to execute arbitrary commands on a realm's master Kerberos KDC.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CVE-2004-1189 to this issue.
Additionally a temporary file bug was found in the Kerberos krb5-send-pr
program. It is possible that an attacker could create a temporary file
that would allow an arbitrary file to be overwritten which the victim has
write access to. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2004-0971 to this issue.
All users of krb5 should upgrade to these updated packages, which contain
backported security patches to resolve these issues.
Solution:
Please note that this update is available via
Red Hat Network. To use Red Hat Network, launch the Red
Hat Update Agent with the following command: up2date
http://rhn.redhat.com/errata/RHSA-2005-012.html
http://www.securityfocus.com/bid/11289
Risk factor : High
CVSS Score:
7.2
|
