Skip to navigation

Security Advisory Critical: krb5-appl security update

Advisory: RHSA-2011:1852-2
Type: Security Advisory
Severity: Critical
Issued on: 2011-12-27
Last updated on: 2011-12-27
Affected Products: Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux HPC Node (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Server AUS (v. 6.2)
Red Hat Enterprise Linux Server EUS (v. 6.2.z)
Red Hat Enterprise Linux Workstation (v. 6)
CVEs (cve.mitre.org): CVE-2011-4862

Details

Updated krb5-appl packages that fix one security issue are now available
for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having
Critical security impact. A Common Vulnerability Scoring System (CVSS)
base score, which gives a detailed severity rating, is available from the
CVE link in the References section.

The krb5-appl packages provide Kerberos-aware telnet, ftp, rcp, rsh, and
rlogin clients and servers. Kerberos is a network authentication system
which allows clients and servers to authenticate to each other using
symmetric encryption and a trusted third-party, the Key Distribution Center
(KDC).

A buffer overflow flaw was found in the MIT krb5 telnet daemon (telnetd). A
remote attacker who can access the telnet port of a target machine could use
this flaw to execute arbitrary code as root. (CVE-2011-4862)

Note that the krb5 telnet daemon is not enabled by default in any version of
Red Hat Enterprise Linux. In addition, the default firewall rules block
remote access to the telnet port. This flaw does not affect the telnet
daemon distributed in the telnet-server package.

For users who have installed the krb5-appl-servers package, have enabled the
krb5 telnet daemon, and have it accessible remotely, this update should be
applied immediately.

All krb5-appl-server users should upgrade to these updated packages, which
contain a backported patch to correct this issue.


Solution

The krb5 telnet daemon is an xinetd service. You can determine if krb5
telnetd is enabled with the commands:

/sbin/chkconfig --list krb5-telnet
/sbin/chkconfig --list ekrb5-telnet

The output of these commands will display "on" if krb5 telnet is enabled.
krb5 telnet daemon can be immediately disabled with the commands:

/sbin/chkconfig krb5-telnet off
/sbin/chkconfig ekrb5-telnet off

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Updated packages

Red Hat Enterprise Linux Desktop (v. 6)

SRPMS:
krb5-appl-1.0.1-7.el6_2.src.rpm
File outdated by:  RHBA-2012:0550
    MD5: d3d608c3dabba7980950f4fa0b30d766
SHA-256: 669696027d5f6835ba83dcb1aa02ec1b74a70df5ee767d22241ab112bfa78eb0
 
IA-32:
krb5-appl-clients-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8e929345411a57d0ba0e03e243da8076
SHA-256: 28231c8bfe9c7faf91b070414254019ea4adb31247b47d75e2291a61c65c784d
krb5-appl-debuginfo-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: cb3cd4756b76b6e6d34c70a52dae5f65
SHA-256: e60a38aefde5d74f9886532424378df526bcd795dbc992177adc625ac84344a4
krb5-appl-servers-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: c5b84f229241f2787ef71c87372812c5
SHA-256: 67c0b63151adcbb8e42bd080adbc8ca6b20630f2b0e2778bc4e2cc5032c44310
 
x86_64:
krb5-appl-clients-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 244ba0de818cab14a420e57f73cf3c53
SHA-256: b909101a53afe93718362330d7dea6e2019feb08a0dfe1da846b7544365fda4f
krb5-appl-debuginfo-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: ef09a6a15a9eae92d27cb7aac8599371
SHA-256: 476a80a2646e02c1dfbe083492f169ee6428bdf9c91564ad3f421ede06ff8ca2
krb5-appl-servers-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8b94593bf99f308f167fd5de82b4360a
SHA-256: ca69abfc8b282cb485cf2cd54cc48987040c2527da4114e85051c00a277ab201
 
Red Hat Enterprise Linux HPC Node (v. 6)

SRPMS:
krb5-appl-1.0.1-7.el6_2.src.rpm
File outdated by:  RHBA-2012:0550
    MD5: d3d608c3dabba7980950f4fa0b30d766
SHA-256: 669696027d5f6835ba83dcb1aa02ec1b74a70df5ee767d22241ab112bfa78eb0
 
x86_64:
krb5-appl-clients-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 244ba0de818cab14a420e57f73cf3c53
SHA-256: b909101a53afe93718362330d7dea6e2019feb08a0dfe1da846b7544365fda4f
krb5-appl-debuginfo-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: ef09a6a15a9eae92d27cb7aac8599371
SHA-256: 476a80a2646e02c1dfbe083492f169ee6428bdf9c91564ad3f421ede06ff8ca2
krb5-appl-servers-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8b94593bf99f308f167fd5de82b4360a
SHA-256: ca69abfc8b282cb485cf2cd54cc48987040c2527da4114e85051c00a277ab201
 
Red Hat Enterprise Linux Server (v. 6)

SRPMS:
krb5-appl-1.0.1-7.el6_2.src.rpm
File outdated by:  RHBA-2012:0550
    MD5: d3d608c3dabba7980950f4fa0b30d766
SHA-256: 669696027d5f6835ba83dcb1aa02ec1b74a70df5ee767d22241ab112bfa78eb0
 
IA-32:
krb5-appl-clients-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8e929345411a57d0ba0e03e243da8076
SHA-256: 28231c8bfe9c7faf91b070414254019ea4adb31247b47d75e2291a61c65c784d
krb5-appl-debuginfo-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: cb3cd4756b76b6e6d34c70a52dae5f65
SHA-256: e60a38aefde5d74f9886532424378df526bcd795dbc992177adc625ac84344a4
krb5-appl-servers-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: c5b84f229241f2787ef71c87372812c5
SHA-256: 67c0b63151adcbb8e42bd080adbc8ca6b20630f2b0e2778bc4e2cc5032c44310
 
PPC:
krb5-appl-clients-1.0.1-7.el6_2.ppc64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 41c5b87a08a96e51edc66ff70ed0bd2f
SHA-256: 626789c989c8d1f97793db19750f40dded6006911508f5f97938173c04de2859
krb5-appl-debuginfo-1.0.1-7.el6_2.ppc64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 25d147ef502a734908135a55c4919fa5
SHA-256: 3d87e696b7b666db28f9e51c856d191a8777fd6fe7b5c0cb07a5768b954fe75e
krb5-appl-servers-1.0.1-7.el6_2.ppc64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 577fd58e43239f7c66c6bc5a2e0077ac
SHA-256: caad0bb3144ac09d9f9b3447a5f142cb21180b2cf1c075f37a8dc472bc34f57a
 
s390x:
krb5-appl-clients-1.0.1-7.el6_2.s390x.rpm
File outdated by:  RHBA-2012:0550
    MD5: 508089ff916a5c1fa98cfe052ef36392
SHA-256: 3713cc8ee79b660fda40dfae7c983d6509d155eea5d4b00296195a92d87de51e
krb5-appl-debuginfo-1.0.1-7.el6_2.s390x.rpm
File outdated by:  RHBA-2012:0550
    MD5: d380f88ada36f4bcf054f40ca8954301
SHA-256: c87db15549eaa1236f34d24664f18c8154733d633d2983a23c29fa497d1c7917
krb5-appl-servers-1.0.1-7.el6_2.s390x.rpm
File outdated by:  RHBA-2012:0550
    MD5: a173026534bd3d0df439608332ae767b
SHA-256: 507bb02b63d99750986144d8c8ea9dfd5d3703588cc954c53cd9e432f61e574e
 
x86_64:
krb5-appl-clients-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 244ba0de818cab14a420e57f73cf3c53
SHA-256: b909101a53afe93718362330d7dea6e2019feb08a0dfe1da846b7544365fda4f
krb5-appl-debuginfo-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: ef09a6a15a9eae92d27cb7aac8599371
SHA-256: 476a80a2646e02c1dfbe083492f169ee6428bdf9c91564ad3f421ede06ff8ca2
krb5-appl-servers-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8b94593bf99f308f167fd5de82b4360a
SHA-256: ca69abfc8b282cb485cf2cd54cc48987040c2527da4114e85051c00a277ab201
 
Red Hat Enterprise Linux Server AUS (v. 6.2)

SRPMS:
krb5-appl-1.0.1-7.el6_2.src.rpm
File outdated by:  RHBA-2012:0550
    MD5: d3d608c3dabba7980950f4fa0b30d766
SHA-256: 669696027d5f6835ba83dcb1aa02ec1b74a70df5ee767d22241ab112bfa78eb0
 
x86_64:
krb5-appl-clients-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 244ba0de818cab14a420e57f73cf3c53
SHA-256: b909101a53afe93718362330d7dea6e2019feb08a0dfe1da846b7544365fda4f
krb5-appl-debuginfo-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: ef09a6a15a9eae92d27cb7aac8599371
SHA-256: 476a80a2646e02c1dfbe083492f169ee6428bdf9c91564ad3f421ede06ff8ca2
krb5-appl-servers-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8b94593bf99f308f167fd5de82b4360a
SHA-256: ca69abfc8b282cb485cf2cd54cc48987040c2527da4114e85051c00a277ab201
 
Red Hat Enterprise Linux Server EUS (v. 6.2.z)

SRPMS:
krb5-appl-1.0.1-7.el6_2.src.rpm
File outdated by:  RHBA-2012:0550
    MD5: d3d608c3dabba7980950f4fa0b30d766
SHA-256: 669696027d5f6835ba83dcb1aa02ec1b74a70df5ee767d22241ab112bfa78eb0
 
IA-32:
krb5-appl-clients-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8e929345411a57d0ba0e03e243da8076
SHA-256: 28231c8bfe9c7faf91b070414254019ea4adb31247b47d75e2291a61c65c784d
krb5-appl-debuginfo-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: cb3cd4756b76b6e6d34c70a52dae5f65
SHA-256: e60a38aefde5d74f9886532424378df526bcd795dbc992177adc625ac84344a4
krb5-appl-servers-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: c5b84f229241f2787ef71c87372812c5
SHA-256: 67c0b63151adcbb8e42bd080adbc8ca6b20630f2b0e2778bc4e2cc5032c44310
 
PPC:
krb5-appl-clients-1.0.1-7.el6_2.ppc64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 41c5b87a08a96e51edc66ff70ed0bd2f
SHA-256: 626789c989c8d1f97793db19750f40dded6006911508f5f97938173c04de2859
krb5-appl-debuginfo-1.0.1-7.el6_2.ppc64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 25d147ef502a734908135a55c4919fa5
SHA-256: 3d87e696b7b666db28f9e51c856d191a8777fd6fe7b5c0cb07a5768b954fe75e
krb5-appl-servers-1.0.1-7.el6_2.ppc64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 577fd58e43239f7c66c6bc5a2e0077ac
SHA-256: caad0bb3144ac09d9f9b3447a5f142cb21180b2cf1c075f37a8dc472bc34f57a
 
s390x:
krb5-appl-clients-1.0.1-7.el6_2.s390x.rpm
File outdated by:  RHBA-2012:0550
    MD5: 508089ff916a5c1fa98cfe052ef36392
SHA-256: 3713cc8ee79b660fda40dfae7c983d6509d155eea5d4b00296195a92d87de51e
krb5-appl-debuginfo-1.0.1-7.el6_2.s390x.rpm
File outdated by:  RHBA-2012:0550
    MD5: d380f88ada36f4bcf054f40ca8954301
SHA-256: c87db15549eaa1236f34d24664f18c8154733d633d2983a23c29fa497d1c7917
krb5-appl-servers-1.0.1-7.el6_2.s390x.rpm
File outdated by:  RHBA-2012:0550
    MD5: a173026534bd3d0df439608332ae767b
SHA-256: 507bb02b63d99750986144d8c8ea9dfd5d3703588cc954c53cd9e432f61e574e
 
x86_64:
krb5-appl-clients-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 244ba0de818cab14a420e57f73cf3c53
SHA-256: b909101a53afe93718362330d7dea6e2019feb08a0dfe1da846b7544365fda4f
krb5-appl-debuginfo-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: ef09a6a15a9eae92d27cb7aac8599371
SHA-256: 476a80a2646e02c1dfbe083492f169ee6428bdf9c91564ad3f421ede06ff8ca2
krb5-appl-servers-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8b94593bf99f308f167fd5de82b4360a
SHA-256: ca69abfc8b282cb485cf2cd54cc48987040c2527da4114e85051c00a277ab201
 
Red Hat Enterprise Linux Workstation (v. 6)

SRPMS:
krb5-appl-1.0.1-7.el6_2.src.rpm
File outdated by:  RHBA-2012:0550
    MD5: d3d608c3dabba7980950f4fa0b30d766
SHA-256: 669696027d5f6835ba83dcb1aa02ec1b74a70df5ee767d22241ab112bfa78eb0
 
IA-32:
krb5-appl-clients-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8e929345411a57d0ba0e03e243da8076
SHA-256: 28231c8bfe9c7faf91b070414254019ea4adb31247b47d75e2291a61c65c784d
krb5-appl-debuginfo-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: cb3cd4756b76b6e6d34c70a52dae5f65
SHA-256: e60a38aefde5d74f9886532424378df526bcd795dbc992177adc625ac84344a4
krb5-appl-servers-1.0.1-7.el6_2.i686.rpm
File outdated by:  RHBA-2012:0550
    MD5: c5b84f229241f2787ef71c87372812c5
SHA-256: 67c0b63151adcbb8e42bd080adbc8ca6b20630f2b0e2778bc4e2cc5032c44310
 
x86_64:
krb5-appl-clients-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 244ba0de818cab14a420e57f73cf3c53
SHA-256: b909101a53afe93718362330d7dea6e2019feb08a0dfe1da846b7544365fda4f
krb5-appl-debuginfo-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: ef09a6a15a9eae92d27cb7aac8599371
SHA-256: 476a80a2646e02c1dfbe083492f169ee6428bdf9c91564ad3f421ede06ff8ca2
krb5-appl-servers-1.0.1-7.el6_2.x86_64.rpm
File outdated by:  RHBA-2012:0550
    MD5: 8b94593bf99f308f167fd5de82b4360a
SHA-256: ca69abfc8b282cb485cf2cd54cc48987040c2527da4114e85051c00a277ab201
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

770325 - CVE-2011-4862 krb5-appl: remote buffer overflow in kerberised telnet daemon


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/