[Full-Disclosure] GLSA: openafs (200303-26)

From: Daniel Ahlberg (aliz@gentoo.org)
Date: 03/30/03

  • Next message: martin f krafft: "[Full-Disclosure] Re: OpenSSL on Fire." 
    From: Daniel Ahlberg <aliz@gentoo.org>
To: full-disclosure@lists.netsys.com
Date: Sun, 30 Mar 2003 17:50:34 +0200

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - ---------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200303-26
    - - ---------------------------------------------------------------------

              PACKAGE : openafs
              SUMMARY : cryptographic weakness in Kerberos v4
                 DATE : 2003-03-30 15:50 UTC
              EXPLOIT : remote
    VERSIONS AFFECTED : <1.3.2-r1
        FIXED VERSION : >=1.3.2-r1
                  CVE : CAN-2003-0139

    - - ---------------------------------------------------------------------

    - From advisory:
    "A cryptographic weakness in version 4 of the Kerberos protocol allows an
    attacker to use a chosen-plaintext attack to impersonate any principal in a
    realm. OpenAFS kaserver implements version 4 of the Kerberos protocol, and
    therefore is vulnerable. An attacker that knows a shared cross-realm key
    between any remote realm and the local realm can impersonate any principal in
    the local realm to AFS database servers and file servers in the local cell,
    and other services in the local realm. An attacker that can create arbitrary
    principal names in a realm can also impersonate any principal in that realm."

    Read the full advisory at
    http://www.openafs.org/pages/security/OPENAFS-SA-2003-001.txt

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-fs/openafs upgrade to openafs-1.3.2-r1 as follows:

    emerge sync
    emerge openafs
    emerge clean

    - - ---------------------------------------------------------------------
    aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
    rphillips@gentoo.org
    - - ---------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE+hxJFfT7nyhUpoZMRAsX+AJ9EpVL8yVWv6zKDub9dgBf8kNDw6ACfZcyL
    gCOQAEJIogc9cC4AnK7UMzo=
    =01pX
    -----END PGP SIGNATURE-----
    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: martin f krafft: "[Full-Disclosure] Re: OpenSSL on Fire."

    Relevant Pages