-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________

                Mandrake Linux Security Update Advisory
________________________________________________________________________

Package name:           krb5
Advisory ID:            MDKSA-2002:073-1
Date:                   January 13th, 2003
Original Advisory Date: October 29th, 2002
Affected versions:      8.1, 8.2, 9.0
________________________________________________________________________

Problem Description:

 A stack buffer overflow in the implementation of the Kerberos v4
 compatibility administration daemon (kadmind4) in the krb5 package can
 be exploited to gain unauthorized root access to a KDC host.
 Authentication to the daemon is not required to successfully perform
 the attack and according to MIT at least one exploit is known to exist.
 kadmind4 is used only by sites that require compatibility with legacy
 administrative clients, and sites that do not have these needs are
 likely not using kadmind4 and are not affected.
 
 MandrakeSoft encourages all users who use Kerberos to upgrade to these
 packages immediately.
  
Update:

 The /etc/rc.d/init.d/kadmin initscript improperly pointed to a non-existant
 location for the kadmind binary.  This update corrects the problem.
________________________________________________________________________

References:
  
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1235
  http://www.kb.cert.org/vuls/id/875073
  http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-002-kadm4.txt
________________________________________________________________________

Updated Packages:
  
 Mandrake Linux 8.1:
 323c794946dd2d0795ec5f1eb60994b8 
 8.1/RPMS/ftp-client-krb5-1.2.2-17.3mdk.i586.rpm
 c0196c5b5451974c038601f04295ec54 
 8.1/RPMS/ftp-server-krb5-1.2.2-17.3mdk.i586.rpm
 58a6df02b3358a3ee0bb220c4e71d933  8.1/RPMS/krb5-devel-1.2.2-17.3mdk.i586.rpm
 f77670644538cb06aa58456a95f20a27  8.1/RPMS/krb5-libs-1.2.2-17.3mdk.i586.rpm
 04341f6d04e6a5a2be59bc50b3d25614  8.1/RPMS/krb5-server-1.2.2-17.3mdk.i586.rpm
 188419822f768861a658ed55bca08ef1 
 8.1/RPMS/krb5-workstation-1.2.2-17.3mdk.i586.rpm
 e86a979d495096ad3c75f912f9e632c9 
 8.1/RPMS/telnet-client-krb5-1.2.2-17.3mdk.i586.rpm
 0c236fb51882705aa218ae6601a33ce9 
 8.1/RPMS/telnet-server-krb5-1.2.2-17.3mdk.i586.rpm
 263f5558dfc4152252648ca070a7eb40  8.1/SRPMS/krb5-1.2.2-17.3mdk.src.rpm

 Mandrake Linux 8.1/IA64:
 61ba3f9c8583eccdaed9661afd9c04c0 
 ia64/8.1/RPMS/ftp-client-krb5-1.2.2-17.3mdk.ia64.rpm
 7abe524e1f342356d8893003140d273f 
 ia64/8.1/RPMS/ftp-server-krb5-1.2.2-17.3mdk.ia64.rpm
 3770ada21a568ca3e76475211a1af531 
 ia64/8.1/RPMS/krb5-devel-1.2.2-17.3mdk.ia64.rpm
 487c2dd3414fd168b2b5487c77c8b1d7 
 ia64/8.1/RPMS/krb5-libs-1.2.2-17.3mdk.ia64.rpm
 931e557cabbf684162b8156af23c70d1 
 ia64/8.1/RPMS/krb5-server-1.2.2-17.3mdk.ia64.rpm
 0947d63f85c4aaf920880e75e477263b 
 ia64/8.1/RPMS/krb5-workstation-1.2.2-17.3mdk.ia64.rpm
 950412bff51b20583e28866e9c3ea6d6 
 ia64/8.1/RPMS/telnet-client-krb5-1.2.2-17.3mdk.ia64.rpm
 52e2040c7fed7758c336c2385dae336a 
 ia64/8.1/RPMS/telnet-server-krb5-1.2.2-17.3mdk.ia64.rpm
 263f5558dfc4152252648ca070a7eb40  ia64/8.1/SRPMS/krb5-1.2.2-17.3mdk.src.rpm

 Mandrake Linux 8.2:
 440d915e6b39d5fca0079299f35227ab 
 8.2/RPMS/ftp-client-krb5-1.2.2-17.3mdk.i586.rpm
 073ab9ee421ef1a39b0d71bb4d65695b 
 8.2/RPMS/ftp-server-krb5-1.2.2-17.3mdk.i586.rpm
 fd42b8f5ae9b1940214f8284ecce8274  8.2/RPMS/krb5-devel-1.2.2-17.3mdk.i586.rpm
 f641f6ec0d85ea699b77689310ac298d  8.2/RPMS/krb5-libs-1.2.2-17.3mdk.i586.rpm
 b5e881e185014763d07c5a401eb9ab95  8.2/RPMS/krb5-server-1.2.2-17.3mdk.i586.rpm
 05ff68b0a8208b9758fe5f5f9c59d8f8 
 8.2/RPMS/krb5-workstation-1.2.2-17.3mdk.i586.rpm
 a1956d454a10c780b6b24759494019fe 
 8.2/RPMS/telnet-client-krb5-1.2.2-17.3mdk.i586.rpm
 c3d93d81d7cea0c3d861ebd790ad2fe2 
 8.2/RPMS/telnet-server-krb5-1.2.2-17.3mdk.i586.rpm
 263f5558dfc4152252648ca070a7eb40  8.2/SRPMS/krb5-1.2.2-17.3mdk.src.rpm

 Mandrake Linux 8.2/PPC:
 7489a4a40a72a3c7d0ac23cd91b1c623 
 ppc/8.2/RPMS/ftp-client-krb5-1.2.2-17.3mdk.ppc.rpm
 80ef86c8530ee200f973d9d2e23f0563 
 ppc/8.2/RPMS/ftp-server-krb5-1.2.2-17.3mdk.ppc.rpm
 55fcdb4d7d49719cd64e468f8e33da41 
 ppc/8.2/RPMS/krb5-devel-1.2.2-17.3mdk.ppc.rpm
 704fd62b4d69ff45ab093e3bd9ab4b04  ppc/8.2/RPMS/krb5-libs-1.2.2-17.3mdk.ppc.rpm
 d120b6b498a9cc592bc29d60b11648ed 
 ppc/8.2/RPMS/krb5-server-1.2.2-17.3mdk.ppc.rpm
 a29782b7b6b2f7820cfe2af125465efb 
 ppc/8.2/RPMS/krb5-workstation-1.2.2-17.3mdk.ppc.rpm
 9f87d4e92c916acf97ae176b259d726f 
 ppc/8.2/RPMS/telnet-client-krb5-1.2.2-17.3mdk.ppc.rpm
 37e638bcdc5c7bfd2c967a81a8cae105 
 ppc/8.2/RPMS/telnet-server-krb5-1.2.2-17.3mdk.ppc.rpm
 263f5558dfc4152252648ca070a7eb40  ppc/8.2/SRPMS/krb5-1.2.2-17.3mdk.src.rpm

 Mandrake Linux 9.0:
 1fd196b2cbf84fb58bcb9fa83d1b3d71 
 9.0/RPMS/ftp-client-krb5-1.2.5-1.2mdk.i586.rpm
 b6bb6b48289cc350180e743373d8ea35 
 9.0/RPMS/ftp-server-krb5-1.2.5-1.2mdk.i586.rpm
 95628f75c909f201c986c647b293b597  9.0/RPMS/krb5-devel-1.2.5-1.2mdk.i586.rpm
 4b1ce4edcc5c73b567131a2e3f8633f5  9.0/RPMS/krb5-libs-1.2.5-1.2mdk.i586.rpm
 d80438ee2e192b45416a8f849e7047b2  9.0/RPMS/krb5-server-1.2.5-1.2mdk.i586.rpm
 a23ab952296f74b9dad7f7fc0404e5c0 
 9.0/RPMS/krb5-workstation-1.2.5-1.2mdk.i586.rpm
 fdc950553fa7f3fcc200d5e9661c8d9b 
 9.0/RPMS/telnet-client-krb5-1.2.5-1.2mdk.i586.rpm
 97a4e7e29404a7f49fe9f46f3397178e 
 9.0/RPMS/telnet-server-krb5-1.2.5-1.2mdk.i586.rpm
 fd17b5fa3db51eeb35d7da87ea725ee1  9.0/SRPMS/krb5-1.2.5-1.2mdk.src.rpm
________________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):
________________________________________________________________________

To upgrade automatically, use MandrakeUpdate.  The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".  A list of
FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:

  rpm --checksig <filename>

All packages are signed by MandrakeSoft for security.  You can obtain
the GPG public key of the Mandrake Linux Security Team from:

  https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to.  Information on these lists can be obtained by
visiting:

  http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.7 (GNU/Linux)

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPaIRgQQEQIA
BgUCPI+UAwAKCRDniYrgcHcf8xK5AKCm/Mq8qP8GE0o1hEX22QsJMZwH5gCfZ72H
8TacOb3oAmBdprf+K6gkdOiIRgQQEQIABgUCOtOieAAKCRCv2bZyU0yB80MeAJ9K
+jXt0cKuaUonRU+CRGetk6t9dgCfTRRL6/puOKdD6md70+K5EBBSvsG0OE1hbmRy
YWtlIExpbnV4IFNlY3VyaXR5IFRlYW0gPHNlY3VyaXR5QG1hbmRyYWtlc29mdC5j
b20+iFcEExECABcFAjyPnuUFCwcKAwQDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmFi+
AJsHhohgnU3ik4+gy3EdFlB2i/MBoACg6lHn5cnVvTcmgNccWxeNxLLZI5e5AQ0E
OWnn7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ
9F779FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzR
xBXVJb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z
269s+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN
6SCXVl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZ
jTcl3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo
0NAiRYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJ
EJGXlA==
=yGlX
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE+I6rKmqjQ0CJFipgRAvU6AJ453sfflrfM/CHWBQrKD2F59QRFjACeP05x
+ZfhnUJwpyfj9Z2jnrA441I=
=m7JW
-----END PGP SIGNATURE-----