USN-924-1: Kerberos vulnerabilities
7 April 2010
Kerberos vulnerabilities
Releases
Packages
- krb5 -
Details
Sol Jerome discovered that the Kerberos kadmind service did not correctly
free memory. An unauthenticated remote attacker could send specially
crafted traffic to crash the kadmind process, leading to a denial of
service. (CVE-2010-0629)
It was discovered that Kerberos did not correctly free memory in
the GSSAPI library. If a remote attacker were able to manipulate an
application using GSSAPI carefully, the service could crash, leading to
a denial of service. (Ubuntu 8.10 was not affected.) (CVE-2007-5901,
CVE-2007-5971)
It was discovered that Kerberos did not correctly free memory in the
GSSAPI and kdb libraries. If a remote attacker were able to manipulate
an application using these libraries carefully, the service could crash,
leading to a denial of service. (Only Ubuntu 8.04 LTS was affected.)
(CVE-2007-5902, CVE-2007-5972)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 9.04
Ubuntu 8.10
Ubuntu 8.04
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Related notices
- USN-940-1: libkrb53, krb5-kdc, krb5-admin-server, krb5