--------------------------------------------------------------------------------Fedora Update Notification
FEDORA-2009-2852
2009-03-18 18:33:45
--------------------------------------------------------------------------------Name        : krb5
Product     : Fedora 10
Version     : 1.6.3
Release     : 18.fc10
URL         : http://web.mit.edu/kerberos/www/
Summary     : The Kerberos network authentication system.
Description :
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of cleartext passwords.

--------------------------------------------------------------------------------Update Information:

This update incorporates patches to fix potential read overflow and NULL pointer
dereferences in the implementation of the SPNEGO GSSAPI mechanism
(CVE-2009-0844, CVE-2009-0845), attempts to free an uninitialized pointer during
protocol parsing (CVE-2009-0846), and a bug in length validation during protocol
parsing (CVE-2009-0847).
--------------------------------------------------------------------------------ChangeLog:

* Tue Apr  7 2009 Nalin Dahyabhai  1.6.3-18
- add patches for read overflow and null pointer dereference in the
  implementation of the SPNEGO mechanism (CVE-2009-0844, CVE-2009-0845)
- add patch for attempt to free uninitialized pointer in libkrb5
  (CVE-2009-0846)
- add patch to fix length validation bug in libkrb5 (CVE-2009-0847)
* Tue Mar 17 2009 Nalin Dahyabhai  1.6.3-17
- libgssapi_krb5: backport fix for some errors which can occur when
  we fail to set up the server half of a context (CVE-2009-0845)
* Thu Sep  4 2008 Nalin Dahyabhai 
- if we successfully change the user's password during an attempt to get
  initial credentials, but then fail to get initial creds from a non-master
  using the new password, retry against the master (#432334)
--------------------------------------------------------------------------------References:

  [ 1 ] Bug #490634 - CVE-2009-0845 krb5: Null pointer dereference in GSSAPI SPNEGO security mechanism
        https://bugzilla.redhat.com/show_bug.cgi?id=490634
  [ 2 ] Bug #491033 - CVE-2009-0844 krb5: buffer over-read in SPNEGO GSS-API mechanism (MITKRB5-SA-2009-001)
        https://bugzilla.redhat.com/show_bug.cgi?id=491033
  [ 3 ] Bug #491036 - CVE-2009-0846 krb5: ASN.1 decoder can free uninitialized pointer when decoding an invalid encoding (MITKRB5-SA-2009-002)
        https://bugzilla.redhat.com/show_bug.cgi?id=491036
  [ 4 ] Bug #491034 - CVE-2009-0847 krb5: incorrect length check inside ASN.1 decoder (MITKRB5-SA-2009-001)
        https://bugzilla.redhat.com/show_bug.cgi?id=491034
--------------------------------------------------------------------------------This update can be installed with the "yum" update program.  Use 
su -c 'yum update krb5' at the command line.
For more information, refer to "Managing Software with yum",
available at .

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
--------------------------------------------------------------------------------_______________________________________________
Fedora-package-announce mailing list
Fedora-package-announce@redhat.com
http://www.redhat.com/mailman/listinfo/fedora-package-announce