File _patchinfo of Package patchinfo.330

<patchinfo incident="330">
  <issue id="912002" tracker="bnc">VUL-0: EMBARGOED: CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423: krb5: Vulnerabilities in kadmind, libgssrpc, gss_process_context_token</issue>
  <issue id="897874" tracker="bnc">L3: VUL-1: CVE-2014-5351: krb5: current keys returned when randomizing the keys for a service principal</issue>
  <issue id="898439" tracker="bnc">Fix the race condition with the libkrb5 replay cache</issue>
  <issue id="CVE-2014-5352" tracker="cve" />
  <issue id="CVE-2014-5351" tracker="cve" />
  <issue id="CVE-2014-9421" tracker="cve" />
  <issue id="CVE-2014-9423" tracker="cve" />
  <issue id="CVE-2014-9422" tracker="cve" />
  <category>security</category>
  <rating>important</rating>
  <packager>varkoly</packager>
  <description>
MIT kerberos krb5 was updated to fix several security issues and bugs.

Security issues fixed:
CVE-2014-5351: The kadm5_randkey_principal_3 function in
lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5)
sent old keys in a response to a -randkey -keepold request, which allowed
remote authenticated users to forge tickets by leveraging administrative
access.

CVE-2014-5352: In the MIT krb5 libgssapi_krb5 library, after
gss_process_context_token() is used to process a valid context
deletion token, the caller was left with a security context handle
containing a dangling pointer.  Further uses of this handle would have
resulted in use-after-free and double-free memory access violations.
libgssrpc server applications such as kadmind were vulnerable as they
can be instructed to call gss_process_context_token().

CVE-2014-9421: If the MIT krb5 kadmind daemon receives invalid XDR
data from an authenticated user, it may have performed use-after-free and
double-free memory access violations while cleaning up the partial
deserialization results. Other libgssrpc server applications might also
been vulnerable if they contain insufficiently defensive XDR functions.

CVE-2014-9422: The MIT krb5 kadmind daemon incorrectly accepted
authentications to two-component server principals whose first
component is a left substring of "kadmin" or whose realm is a left
prefix of the default realm.

CVE-2014-9423: libgssrpc applications including kadmind output four or
eight bytes of uninitialized memory to the network as part of an
unused "handle" field in replies to clients.

Bugs fixed:
- Work around replay cache creation race; (bnc#898439).
</description>
  <summary>Security update for krb5</summary>
</patchinfo>
Places

File _patchinfo of Package patchinfo.330

Places
