Bug 17694

Summary:	Security hole in v4 cross-realm in Heimdal and kth-krb
Product:	Gentoo Linux	Reporter:	Ian <ian>
Component:	New packages	Assignee:	Gentoo Security <security>
Status:	RESOLVED DUPLICATE
Severity:	critical
Priority:	High
Version:	1.2
Hardware:	All
OS:	Linux
URL:	http://www.pdc.kth.se/heimdal/
Whiteboard:
Package list:		Runtime testing required:	---

Description Ian 2003-03-17 12:02:56 UTC

See URL and http://www.pdc.kth.se/kth-krb/new versions of kth-krb and heimdalBump ebuild versions (kth-krb-1.2.2 and heimdal-0.5.2)

Comment 1 Martin Holzer (RETIRED) gentoo-dev

2003-03-17 13:15:09 UTC

2003-03-17: Security advisory regarding v4 cross-realm
All versions of the kerberos server are vulnerable to a protocol bug in the kerberos v4 cross-realm operation. Release 1.2.2 by default disables cross-realm in the server, and adds an option for enabling it. The long-term fix is to migrate to Kerberos v5.

Comment 2 Martin Holzer (RETIRED) gentoo-dev

2003-03-17 18:06:06 UTC


*** This bug has been marked as a duplicate of 17718 ***