Red Hat Security Advisory

RHSA-2008:0181

krb5 security update

Released 2008-03-18 · Red Hat rating Critical · View on Red Hat →

Fixed in

Red Hat Desktop version 3 krb5-1.2.7-68, krb5-devel-1.2.7-68, krb5-devel-1.2.7-68.i386 +6
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 krb5-1.2.2-48, krb5-devel-1.2.2-48.i386, krb5-devel-1.2.2-48.ia64 +6
Red Hat Enterprise Linux AS version 3 krb5-1.2.7-68, krb5-devel-1.2.7-68, krb5-devel-1.2.7-68.i386 +14
Red Hat Enterprise Linux ES version 2.1 krb5-1.2.2-48, krb5-devel-1.2.2-48.i386, krb5-libs-1.2.2-48.i386 +2
Red Hat Enterprise Linux ES version 3 krb5-1.2.7-68, krb5-devel-1.2.7-68, krb5-devel-1.2.7-68.i386 +10
Red Hat Enterprise Linux WS version 2.1 krb5-1.2.2-48, krb5-devel-1.2.2-48.i386, krb5-libs-1.2.2-48.i386 +2
Red Hat Enterprise Linux WS version 3 krb5-1.2.7-68, krb5-devel-1.2.7-68, krb5-devel-1.2.7-68.i386 +10
Red Hat Linux Advanced Workstation 2.1 krb5-1.2.2-48, krb5-devel-1.2.2-48.ia64, krb5-libs-1.2.2-48.ia64 +2

Fixes 3 records

TI-2008-00053 CVE-2008-0062 · GHSA-f6c2-j3p8-vxvv

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message…

MEDIUM 54

KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted messages that…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.10141 Published 2008-03-19 Fixed CWE-665

TI-2008-00911 CVE-2008-0948 · GHSA-9qjv-6f4r-w76q

Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and…

MEDIUM 50

Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define t…

CVSS 2.0HIGH 9.3 Network No auth Interaction — EPSS 0.07273 Published 2008-03-19 Fixed CWE-119

TI-2008-00054 CVE-2008-0063 · GHSA-67px-r9v8-hcfg

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the…

LOW 39

The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote attackers to obtain sensitive information, aka "…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03478 Published 2008-03-19 Fixed CWE-908