| Description: | Description:
The remote host is missing an update to krb5
announced via advisory USN-924-1.
Details follow:
Sol Jerome discovered that the Kerberos kadmind service did not correctly
free memory. An unauthenticated remote attacker could send specially
crafted traffic to crash the kadmind process, leading to a denial of
service. (CVE-2010-0629)
It was discovered that Kerberos did not correctly free memory in
the GSSAPI library. If a remote attacker were able to manipulate an
application using GSSAPI carefully, the service could crash, leading to
a denial of service. (Ubuntu 8.10 was not affected.) (CVE-2007-5901,
CVE-2007-5971)
It was discovered that Kerberos did not correctly free memory in the
GSSAPI and kdb libraries. If a remote attacker were able to manipulate
an application using these libraries carefully, the service could crash,
leading to a denial of service. (Only Ubuntu 8.04 LTS was affected.)
(CVE-2007-5902, CVE-2007-5972)
Solution:
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
krb5-kdc 1.6.dfsg.3~
beta1-2ubuntu1.4
libkrb53 1.6.dfsg.3~
beta1-2ubuntu1.4
Ubuntu 8.10:
krb5-kdc 1.6.dfsg.4~
beta1-3ubuntu0.4
Ubuntu 9.04:
krb5-kdc 1.6.dfsg.4~
beta1-5ubuntu2.3
libkrb53 1.6.dfsg.4~
beta1-5ubuntu2.3
In general, a standard system upgrade is sufficient to effect the
necessary changes.
http://www.securityspace.com/smysecure/catid.html?in=USN-924-1
Risk factor : Critical
CVSS Score:
10.0
|
