| Summary: | krb5 new security issues CVE-2013-1417 and CVE-2013-1418 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | major | ||
| Priority: | Normal | CC: | davidwhodgins, guillomovitch, oe, sysadmin-bugs, tmb |
| Version: | 3 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | i586 | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/574583/ | ||
| Whiteboard: | MGA2TOO MGA3-64-OK MGA3-32-OK MGA2-64-OK MGA2-32-OK advisory | ||
| Source RPM: | krb5-1.11.3-3.mga4.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2013-11-14 15:52:30 CET
David Walser
2013-11-14 15:52:38 CET
Whiteboard:
(none) =>
MGA3TOO, MGA2TOO Just compiling the advisories for when we do push this to QA. BTW the commit log entry for CVE-2013-1417 confirms that only 1.11.x is vulnerable. CVE-2013-1418 was also fixed in 1.10.7 for that branch. Advisory (Mageia 2): ======================== Updated krb5 packages fix security vulnerabilities: If a KDC serves multiple realms, certain requests can cause setup_server_realm() to dereference a null pointer, crashing the KDC. This can be triggered by an unauthenticated user (CVE-2013-1418). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1418 http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1418 ======================== Updated packages in core/updates_testing: ======================== krb5-1.9.2-2.7.mga2 libkrb53-1.9.2-2.7.mga2 libkrb53-devel-1.9.2-2.7.mga2 krb5-server-1.9.2-2.7.mga2 krb5-server-ldap-1.9.2-2.7.mga2 krb5-workstation-1.9.2-2.7.mga2 krb5-pkinit-openssl-1.9.2-2.7.mga2 from krb5-1.9.2-2.7.mga2.src.rpm Advisory (Mageia 3): ======================== Updated krb5 packages fix security vulnerabilities: An authenticated remote client can cause a KDC to crash by making a valid TGS-REQ to a KDC serving a realm with a single-component name. The process_tgs_req() function dereferences a null pointer because an unusual failure condition causes a helper function to return success (CVE-2013-1417). If a KDC serves multiple realms, certain requests can cause setup_server_realm() to dereference a null pointer, crashing the KDC. This can be triggered by an unauthenticated user (CVE-2013-1418). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1417 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1418 http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1418 ======================== Updated packages in core/updates_testing: ======================== krb5-1.11.1-1.3.mga3 libkrb53-devel-1.11.1-1.3.mga3 libkrb53-1.11.1-1.3.mga3 krb5-server-1.11.1-1.3.mga3 krb5-server-ldap-1.11.1-1.3.mga3 krb5-workstation-1.11.1-1.3.mga3 krb5-pkinit-openssl-1.11.1-1.3.mga3 from krb5-1.11.1-1.3.mga3.src.rpm krb5-1.11.4-1.mga4 uploaded for Cauldron. Thanks Guillaume! Version:
Cauldron =>
3 Patched packages uploaded for Mageia 2 and Mageia 3. Advisories and package lists in Comment 1. CC:
(none) =>
guillomovitch Testing complete on Mageia 2 and 3, i586 and x86_64. Could someone from the sysadmin team push the advisories 11668.mga2.adv and 11668.mga3.adv to updates. CC:
(none) =>
davidwhodgins
claire robinson
2013-11-18 19:40:24 CET
Keywords:
(none) =>
validated_update ====================================================== Name: CVE-2013-6800 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6800 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20131115 Category: Reference: CONFIRM:http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757 Reference: CONFIRM:https://github.com/krb5/krb5/commit/c2ccf4197f697c4ff143b8a786acdd875e70a89d An unspecified third-party database module for the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request, a different vulnerability than CVE-2013-1418. CC:
(none) =>
oe
Oden Eriksson
2013-11-19 10:24:09 CET
Summary:
krb5 new security issues CVE-2013-1417 and CVE-2013-1418 =>
krb5 new security issues CVE-2013-1417, CVE-2013-1418, CVE-2013-6800 I concur with the RedHat folks that CVE-2013-6800 shouldn't have been assigned for this; it's just a simple NULL pointer dereference and it's CVE-2013-1418. We don't have 1.10.x packaged, and our update is for 1.11.x for Mageia 3. For 1.9.x for Mageia 2, I don't see any reason to call it anything other than CVE-2013-1418. https://bugzilla.redhat.com/show_bug.cgi?id=1031499 Summary:
krb5 new security issues CVE-2013-1417, CVE-2013-1418, CVE-2013-6800 =>
krb5 new security issues CVE-2013-1417 and CVE-2013-1418 Mga2 update pushed: http://advisories.mageia.org/MGASA-2013-0335.html Mga3 update pushed: http://advisories.mageia.org/MGASA-2013-0336.html Status:
NEW =>
RESOLVED
David Walser
2013-11-21 16:45:10 CET
URL:
(none) =>
http://lwn.net/Vulnerabilities/574583/ |