DSA-520-1 krb5 -- buffer overflows

Debian Security Advisory

DSA-520-1 krb5 -- buffer overflows

Date Reported:

16 Jun 2004

Affected Packages:

krb5

Vulnerable:

Yes

Security database references:

In the Bugtraq database (at SecurityFocus): BugTraq ID 10448.
In Mitre's CVE dictionary: CVE-2004-0523.

More information:

In their advisory MITKRB5-SA-2004-001, the MIT Kerberos announced the existence of buffer overflow vulnerabilities in the krb5_aname_to_localname function. This function is only used if aname_to_localname is enabled in the configuration (this is not enabled by default).

For the current stable distribution (woody), this problem has been fixed in version 1.2.4-5woody5.

For the unstable distribution (sid), this problem has been fixed in version 1.3.3-2.

We recommend that you update your krb5 package.

Fixed in:

Debian GNU/Linux 3.0 (woody)

Source:

http://security.debian.org/pool/updates/main/k/krb5/krb5_1.2.4-5woody5.dsc

http://security.debian.org/pool/updates/main/k/krb5/krb5_1.2.4-5woody5.diff.gz

http://security.debian.org/pool/updates/main/k/krb5/krb5_1.2.4.orig.tar.gz

Architecture-independent component:

http://security.debian.org/pool/updates/main/k/krb5/krb5-doc_1.2.4-5woody5_all.deb

Alpha:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_alpha.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_alpha.deb

ARM:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_arm.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_arm.deb

Intel IA-32:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_i386.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_i386.deb

Intel IA-64:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_ia64.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_ia64.deb

HPPA:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_hppa.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_hppa.deb

Motorola 680x0:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_m68k.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_m68k.deb

Big endian MIPS:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_mips.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_mips.deb

Little endian MIPS:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_mipsel.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_mipsel.deb

PowerPC:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_powerpc.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_powerpc.deb

IBM S/390:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_s390.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_s390.deb

Sun Sparc:

http://security.debian.org/pool/updates/main/k/krb5/krb5-admin-server_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-clients_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-ftpd_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-kdc_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-rsh-server_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-telnetd_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/krb5-user_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/libkadm55_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb5-dev_1.2.4-5woody5_sparc.deb

http://security.debian.org/pool/updates/main/k/krb5/libkrb53_1.2.4-5woody5_sparc.deb

MD5 checksums of the listed files are available in the original advisory.