krb5-1.6.1-17AXS3.1

Kerberos V5 is a trusted-third-party network authentication system, which can improve your network's security by eliminating the insecure practice of cleartext passwords.
- add preliminary patch to fix use of uninitialized pointer / double-free in KDC (CVE-2008-0062,CVE-2008-0063)
- add backported patch to fix use-after-free in libgssapi_krb5 (CVE-2007-5901)
- add backported patch to fix double-free in libgssapi_krb5 (CVE-2007-5971)
- add preliminary patch to fix incorrect handling of high-numbered descriptors in the RPC library (CVE-2008-0947)
- fix storage of delegated krb5 credentials when they've been wrapped up in spnego
- return a delegated credential handle even if the application didn't pass a location to store the flags which would be used to indicate that credentials were delegated
- add patch to fall back to TCP kpasswd servers for kdc-unreachable, can't-resolve-server, and response-too-big errors
- use the right sequence numbers when generating password-set/change requests for kpasswd servers after the first one
- backport from 1.6.3 to initialize a library-allocated get_init_creds_opt structure the same way we would one which was allocated by the calling application, to restore kinit's traditional behavior of doing a password change right when it detects an expired password
- ftpd: also do PAM session and credential management when ftp clients use strong authentication
- update to revised patch for CVE-2007-3999
- fix omission of files created by the db2 plugin when labeling
- make krb5-workstation depend on the PAM configuration file used by login.krb5
- fix omission of kadmin log file when labeling
- add preliminary patch to fix buffer overflow in rpcsec_gss implementation in libgssrpc (CVE-2007-3999) and write through uninitialized pointer in kadmind (CVE-2007-4000)
- kdc: default to listening for TCP clients as well
- login: change to the user's home directory after dropping privileges, not before
- turn off the ldap features
- add a patch to allow applications to try to use a key with kvno=0, if found, in place of the right version for a request
- incorporate fixes for MITKRB5-SA-2007-004 (CVE-2007-2442,CVE-2007-2443) and MITKRB5-SA-2007-005 (CVE-2007-2798)
- reintroduce missing %postun for the non-split_workstation case
- add missing pam-devel build requirement, force selinux-or-fail build
- label all files at creation-time according to the SELinux policy
- perform PAM account / session management in krshd
- perform PAM authentication and account / session management in ftpd
- perform PAM authentication, account / session management, and password- changing in login.krb5
- preprocess kerberos.ldif into a format FDS will like better, and include that as a doc file as well
- switch man pages to being generated with the right paths in them
- drop old, incomplete SELinux patch
- add patch from Greg Hudson to make srvtab routines report missing-file errors at same point that keytab routines do
- pull patch from svn to undo unintentional chattiness in ftp
- pull patch from svn to handle NULL krb5_get_init_creds_opt structures better in a couple of places where they're expected
- update to 1.6.1
- drop no-longer-needed patches for CVE-2007-0956,CVE-2007-0957,CVE-2007-1216
- drop patch for sendto bug in 1.6, fixed in 1.6.1
- kadmind.init: don't fail outright if the default principal database isn't there if it looks like we might be using the kldap plugin
- kadmind.init: attempt to extract the key for the host-specific kadmin service when we try to create the keytab
- omit dependent libraries from the krb5-config --libs output, as using shared libraries (no more static libraries) makes them unnecessary and they're not part of the libkrb5 interface (strips out libkeyutils, libresolv, libdl)
- pull in keyutils as a build requirement to get the KEYRING: ccache type, because we've merged
- fix an uninitialized length value which could cause a crash when parsing key data coming from a directory server
- correct a typo in the krb5.conf man page (ldap_server->ldap_servers)
- move the default acl_file, dict_file, and admin_keytab settings to the part of the default/example kdc.conf where they'll actually have an effect
- add patch to correct unauthorized access via krb5-aware telnetdaemon (CVE-2007-0956)
- add patch to fix buffer overflow in krb5kdc and kadmind(CVE-2007-0957)
- add patch to fix double-free in kadmind (CVE-2007-1216)
- back out buildrequires: keyutils-libs-devel for now
- add buildrequires: on keyutils-libs-devel to enab