Gentoo: openafs Cryptographic weakness vulnerability
A cryptographic weakness in version 4 of the Kerberos protocol allows anattacker to use a chosen-plaintext attack to impersonate any principal in arealm
Summary
- --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200303-26 - ---------------------------------------------------------------------
- ---------------------------------------------------------------------
>From advisory: "A cryptographic weakness in version 4 of the Kerberos protocol allows an attacker to use a chosen-plaintext attack to impersonate any principal in a realm. OpenAFS kaserver implements version 4 of the Kerberos protocol, and therefore is vulnerable. An attacker that knows a shared cross-realm key between any remote realm and the local realm can impersonate any principal in the local realm to AFS database servers and file servers in the local cell, and other services in the local realm. An attacker that can create arbitrary principal names in a realm can also impersonate any principal in that realm."
Read the full advisory at openafs
SOLUTION
It is recommended that all Gentoo Linux users who are running net-fs/openafs upgrade to openafs-1.3.2-r1 as follows:
emerge sync emerge openafs emerge clean
- --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at rphillips@gentoo.org - ---------------------------------------------------------------------
1.3.2-r1
Resolution
References
Availability
Concerns
Severity
PACKAGE : openafs
SUMMARY : cryptographic weakness in Kerberos v4
DATE : 2003-03-30 15:50 UTC
EXPLOIT : remote
VERSIONS AFFECTED : <1.3.2-r1 : fixed version>=1.3.2-r1
CVE : CAN-2003-0139
