Security World: [SECURITY] [DSA-2129-1] New krb5 packages fix checksum verification weakness

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2129-1 security@debian.org
http://www.debian.org/security/ Stefan Fritsch
December 1, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : krb5
Vulnerability : checksum verification weakness
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2010-1323

A vulnerability has been found in krb5, the MIT implementation of
Kerberos.

MIT krb5 clients incorrectly accept an unkeyed checksums in the SAM-2
preauthentication challenge: An unauthenticated remote attacker could
alter a SAM-2 challenge, affecting the prompt text seen by the user or
the kind of response sent to the KDC. Under some circumstances, this
can negate the incremental security benefit of using a single-use
authentication mechanism token.

MIT krb5 incorrectly accepts RFC 3961 key-derivation checksums using
RC4 keys when verifying KRB-SAFE messages: An unauthenticated remote
attacker has a 1/256 chance of forging KRB-SAFE messages in an
application protocol if the targeted pre-existing session uses an RC4
session key. Few application protocols use KRB-SAFE messages.

The Common Vulnerabilities and Exposures project has assigned
CVE-2010-1323 to these issues.

For the stable distribution (lenny), these problems have been fixed in
version 1.6.dfsg.4~beta1-5lenny6.

The builds for the mips architecture are not included in this advisory.
They will be released as soon as they are available.

For the testing distribution (squeeze) and the unstable distribution
(sid), these problem have been fixed in version 1.8.3+dfsg-3.

We recommend that you upgrade your krb5 packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny (stable)
- -----------------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/k/krb5/krb5_1.6.dfsg.4~beta1-5lenny6.dsc
Size/MD5 checksum: 1537 6f0899080bda14e0a277120d9395a707
http://security.debian.org/pool/updates/main/k/krb5/krb5_1.6.dfsg.4~beta1-5lenny6.diff.gz
Size/MD5 checksum: 850645 fe444178e83d0010636cf3c50129a437
http://security.debian.org/pool/updates/main/k/krb5/krb5_1.6.dfsg.4~beta1.orig.tar.gz
Size/MD5 checksum: 11647547 08d6ce311204803acbe878ef0bb23c71

Architecture independent packages:

http://security.debian.org/pool/updates/main/k/krb5/krb5-doc_1.6.dfsg.4~beta1-5lenny6_all.deb
Size/MD5 checksum: 2147158 2cfbb257055a479cfd20c28ac036841a

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD8DBQFM9q24bxelr8HyTqQRArCDAKDXrDve63kXEYOhsViRVtXwVCZVtQCfevC1
GLEfE5ATXnbbbgKo+WzHp+w=
=CGdv
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/E1PNtAt-0004Ep-6i@chopin.debian.org

Security World

Wednesday, December 01, 2010

[SECURITY] [DSA-2129-1] New krb5 packages fix checksum verification weakness

No comments:

Post a Comment