FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor


 
 
LinkBack Thread Tools
 
Old 10-19-2011, 02:10 AM
Stéphane Gaudreault
 
Default krb5-1.9.1-5

This update apply an upstream patch that fix the following KDC denial of
service vulnerabilities [1] :

CVE-2011-1527: In releases krb5-1.9 and later, the KDC can crash due
to a null pointer dereference if configured to use the LDAP back end.
A trigger condition is publicly known but not known to be widely
circulated.

CVE-2011-1528: In releases krb5-1.8 and later, the KDC can crash due
to an assertion failure. No exploit is known to exist, but there is
public evidence that the unidentified trigger condition occurs in the
field.

CVE-2011-1529: In releases krb5-1.8 and later, the KDC can crash due
to a null pointer dereference. No exploit is known to exist.

Please test and signoff.

I am not sure I will have internet access at the hotel in the next days, so
feel free to move this to [core] once it gets the required signoffs.

Cheers,

Stéphane

[1] http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt
 
Old 10-19-2011, 04:45 AM
Gaetan Bisson
 
Default krb5-1.9.1-5

[2011-10-18 22:10:01 -0400] Stéphane Gaudreault:
> This update apply an upstream patch that fix the following KDC denial of
> service vulnerabilities [1] :
>
> CVE-2011-1527: In releases krb5-1.9 and later, the KDC can crash due
> to a null pointer dereference if configured to use the LDAP back end.
> A trigger condition is publicly known but not known to be widely
> circulated.
>
> CVE-2011-1528: In releases krb5-1.8 and later, the KDC can crash due
> to an assertion failure. No exploit is known to exist, but there is
> public evidence that the unidentified trigger condition occurs in the
> field.
>
> CVE-2011-1529: In releases krb5-1.8 and later, the KDC can crash due
> to a null pointer dereference. No exploit is known to exist.

Signoff x86_64.

--
Gaetan
 
Old 10-19-2011, 08:38 PM
Ionut Biru
 
Default krb5-1.9.1-5

On 10/19/2011 05:10 AM, Stéphane Gaudreault wrote:

This update apply an upstream patch that fix the following KDC denial of
service vulnerabilities [1] :

CVE-2011-1527: In releases krb5-1.9 and later, the KDC can crash due
to a null pointer dereference if configured to use the LDAP back end.
A trigger condition is publicly known but not known to be widely
circulated.

CVE-2011-1528: In releases krb5-1.8 and later, the KDC can crash due
to an assertion failure. No exploit is known to exist, but there is
public evidence that the unidentified trigger condition occurs in the
field.

CVE-2011-1529: In releases krb5-1.8 and later, the KDC can crash due
to a null pointer dereference. No exploit is known to exist.

Please test and signoff.

I am not sure I will have internet access at the hotel in the next days, so
feel free to move this to [core] once it gets the required signoffs.

Cheers,

Stéphane

[1] http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt


signoff i686

--
IonuÈ›
 

Thread Tools




All times are GMT. The time now is 09:00 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org