Here's something I noticed while preparing the advisory for a security update for krb5-appl (Bug 2064). For CVE-2011-4862, Mandriva's advisory says this: "In Mandriva the telnetd daemon from the netkit-telnet-server package does not have an initscript to start and stop the service, however one could rather easily craft an initscript or start the service by other means rendering the system vulnerable to this issue." And to go along with that they also issued an update for their netkit-telnet package (MDV 2011 only, same netkit-telnet version we have). I imagine this applies to us as well. If so, both Mageia 1 and Cauldron would be affected. Given the information in the advisory, it's unlikely that many people are directly affected by it, so I'll leave it up to the maintainer's discretion as to whether to issue an update for Mageia 1. The advisory is here: http://www.mandriva.com/en/support/security/advisories/?dis=2010.1&name=MDVSA-2011:195
CC: (none) => boklm
Hi, thanks for reporting this bug. Assigned to the package maintainer. (Please set the status to 'assigned' if you are working on it)
Keywords: (none) => TriagedAssignee: bugsquad => boklm
I have fixed this in Cauldron. The patch is in SVN in Mageia 1. We can issue an update if someone feels it's necessary.
ping ?
In the mandriva advisory, they do list 2010.1, so we will need the update for users upgrading from 2010.2. Mandriva has krb5-appl-clients-1.0-4.2mdv2010.2 Mageia 1 has krb5-appl-clients-1.0.1-2.3.1.mga1 Note that prior testing, https://bugs.mageia.org/show_bug.cgi?id=2064#c22 showed the Mageia 1 kerberos servers don't work with kerberos authentication, so the only testing that will be done is without authentication.
CC: (none) => davidwhodgins
We have already updated krb5-appl and we have a newer version, and that's not what this bug was for. It was for the netkit-telnet package, which was affected by the same CVE. Mandriva only updated it in 2011 and noted that it's not actually vulnerable to the flaw out of the box. I can build an update for it if anyone thinks it's necessary, otherwise, I've fixed it in Cauldron, so this could be closed.
Closing as per comment 5.
Status: NEW => RESOLVEDResolution: (none) => FIXED
CC: boklm => (none)