Bug 15542 - krb5 new security issue CVE-2014-5355
Summary: krb5 new security issue CVE-2014-5355
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 4
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: http://lwn.net/Vulnerabilities/637409/
Whiteboard: has_procedure advisory MGA4-64-OK MGA...
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2015-03-20 18:54 CET by David Walser
Modified: 2015-03-27 22:13 CET (History)
3 users (show)

See Also:
Source RPM: krb5-1.12.2-6.mga5.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2015-03-20 18:54:12 CET
OpenSuSE has issue an advisory on March 19:
http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html

Upstream patch checked into Mageia 4 and Cauldron SVN.  Freeze push requested.

Reproducible: 

Steps to Reproduce:
David Walser 2015-03-20 18:55:58 CET

Whiteboard: (none) => MGA5TOO, MGA4TOO

Sander Lepik 2015-03-21 19:10:07 CET

CC: (none) => mageia
Assignee: bugsquad => guillomovitch

Comment 1 David Walser 2015-03-23 21:01:11 CET
Patched packages uploaded for Mageia 4 and Cauldron.

Advisory:
========================

Updated krb5 packages fix security vulnerability:

MIT Kerberos 5 through 1.13.1 incorrectly expects that a krb5_read_message
data field is represented as a string ending with a '\0' character, which
allows remote attackers to cause a denial of service (NULL pointer
dereference) via a zero-byte version string or cause a denial of service
(out-of-bounds read) by omitting the '\0' character, related to
appl/user_user/server.c and lib/krb5/krb/recvauth.c (CVE-2014-5355).

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5355
http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html
========================

Updated packages in core/updates_testing:
========================
krb5-1.11.4-1.5.mga4
libkrb53-devel-1.11.4-1.5.mga4
libkrb53-1.11.4-1.5.mga4
krb5-server-1.11.4-1.5.mga4
krb5-server-ldap-1.11.4-1.5.mga4
krb5-workstation-1.11.4-1.5.mga4
krb5-pkinit-openssl-1.11.4-1.5.mga4

from krb5-1.11.4-1.5.mga4.src.rpm

Version: Cauldron => 4
Assignee: guillomovitch => qa-bugs
Whiteboard: MGA5TOO, MGA4TOO => (none)

Comment 2 David Walser 2015-03-23 21:01:23 CET
Testing procedure:
https://wiki.mageia.org/en/QA_procedure:Krb5

Whiteboard: (none) => has_procedure

Dave Hodgins 2015-03-27 17:15:35 CET

CC: (none) => davidwhodgins
Whiteboard: has_procedure => has_procedure advisory

Comment 3 Dave Hodgins 2015-03-27 17:31:00 CET
Testing complete on Mageia 4 i586 and x86_64. Advisory committed to svn.

Someone from the sysadmin team please push 15542.adv to updates.

Keywords: (none) => validated_update
Whiteboard: has_procedure advisory => has_procedure advisory MGA4-64-OK MGA4-32-OK
CC: (none) => sysadmin-bugs

Comment 4 Mageia Robot 2015-03-27 22:13:13 CET
An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2015-0119.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.