Login
Newsletter
Werbung

Sicherheit: Preisgabe von Informationen in pam_krb5
Aktuelle Meldungen Distributionen
Name: Preisgabe von Informationen in pam_krb5
ID: MDVSA-2010:054
Distribution: Mandriva
Plattformen: Mandriva 2009.0, Mandriva 2009.1, Mandriva Enterprise Server 5.0
Datum: Do, 4. März 2010, 18:34
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1384
Applikationen: pam_krb5

Originalnachricht

This is a multi-part message in MIME format...

------------=_1267720042-24326-5434


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2010:054
http://www.mandriva.com/security/
_______________________________________________________________________

Package : pam_krb5
Date : March 4, 2010
Affected: 2009.0, 2009.1, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Pam_krb5 2.2.14 through 2.3.4 generates different password prompts
depending on whether the user account exists, which allows remote
attackers to enumerate valid usernames (CVE-2009-1384).

This update provides the version 2.3.5 of pam_krb5, which is not
vulnerable to this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1384
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2009.0:
0d807317d9e0fd0d25b8cdfde550a813
2009.0/i586/pam_krb5-2.3.5-0.1mdv2009.0.i586.rpm
eec3b496e0d49cdf5acc2938e87d7be9
2009.0/SRPMS/pam_krb5-2.3.5-0.1mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
5e51454148dda7c08020265d2c38b8c2
2009.0/x86_64/pam_krb5-2.3.5-0.1mdv2009.0.x86_64.rpm
eec3b496e0d49cdf5acc2938e87d7be9
2009.0/SRPMS/pam_krb5-2.3.5-0.1mdv2009.0.src.rpm

Mandriva Linux 2009.1:
7ee29d86ae8cf64ab1b9a2fa6d84e4de
2009.1/i586/pam_krb5-2.3.5-0.1mdv2009.1.i586.rpm
c032fb6b8490cb5c1898a333e4f8b07e
2009.1/SRPMS/pam_krb5-2.3.5-0.1mdv2009.1.src.rpm

Mandriva Linux 2009.1/X86_64:
8a0ff5a977f141f1c494f316280966c5
2009.1/x86_64/pam_krb5-2.3.5-0.1mdv2009.1.x86_64.rpm
c032fb6b8490cb5c1898a333e4f8b07e
2009.1/SRPMS/pam_krb5-2.3.5-0.1mdv2009.1.src.rpm

Mandriva Enterprise Server 5:
81a267d32261fca0544deb4a41226fb8 mes5/i586/pam_krb5-2.3.5-0.1mdvmes5.i586.rpm

24dbd8d940e0d842577d3ce7f8c7ee00
mes5/SRPMS/pam_krb5-2.3.5-0.1eugeni2010.1.src.rpm

Mandriva Enterprise Server 5/X86_64:
8d5fa51d3bb8b9c1adb9b2f8e65a8885
mes5/x86_64/pam_krb5-2.3.5-0.1mdvmes5.x86_64.rpm
24dbd8d940e0d842577d3ce7f8c7ee00
mes5/SRPMS/pam_krb5-2.3.5-0.1eugeni2010.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFLj7FzmqjQ0CJFipgRAr2uAJ4/lXZzr3XVPgd30y/NNkZdqsh4AACff9XE
Oopf/jjCQ/wYzq1hfiRmXOM=
=lnmi
-----END PGP SIGNATURE-----


------------=_1267720042-24326-5434
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1267720042-24326-5434--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung