krb5-1.10.3-42z1.AXS4
エラータID: AXSA:2016-164:01
リリース日:
2016/03/23 Wednesday - 06:12
題名:
krb5-1.10.3-42z1.AXS4
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- krb5 の kadmind の lib/kadm5/kadm_rpc_xdr.c の xdr_nullstring 関数は，
期待通りにヌル文字が存在しているかどうかを検証しておらず，巧妙に細工された
リモートの認証されたユーザが機密情報を取得する，あるいはサービス拒否を引き
起こす脆弱性があります。(CVE-2015-8629)
- krb5 の kadmind の kadmin/server/server_stubs.c には複数のメモリリー
クが存在し，NULL プリンシパル名を指定するリクエストによって，リモートの認
証されたユーザがサービス拒否 (メモリ消費) を引き起こす脆弱性があります。
(CVE-2015-8631)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2015-8629
The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
CVE-2015-8631
Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.
Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.
追加情報:
N/A
ダウンロード:
SRPMS
- krb5-1.10.3-42z1.AXS4.src.rpm
MD5: 164de459b6f0121827649515632b4ee2
SHA-256: 03756a6130a665c255aab4472191ed17580d7de696f3b35375c311bf7b22d84e
Size: 11.54 MB
Asianux Server 4 for x86
- krb5-devel-1.10.3-42z1.AXS4.i686.rpm
MD5: 6ee005c265e5c209ae1004de4ee11965
SHA-256: 9b69d2f5ed80d135ddd1dbecee746105a22dadcc663ec6673d13dd1f147d395d
Size: 500.37 kB - krb5-libs-1.10.3-42z1.AXS4.i686.rpm
MD5: 67e4fdb0efed77addcdb4124e72773dd
SHA-256: 4e283b0654993529e4dea9fbe46581ec05ca678951af328e3b23585d74845263
Size: 776.32 kB - krb5-pkinit-openssl-1.10.3-42z1.AXS4.i686.rpm
MD5: c645726faf5893ffbc46b3a1b2a1b052
SHA-256: c66ac45b735626d9464ee3113ad12eb71553001c1413d0b6aef542e1c767d923
Size: 123.80 kB - krb5-server-1.10.3-42z1.AXS4.i686.rpm
MD5: 9dd322b30e310a65e966f636b7f8ec68
SHA-256: debd5121a2a69fecf6aa6cbf8c8aa5da40e78b0581664b39cfd6aa421f9e50f0
Size: 1.98 MB - krb5-server-ldap-1.10.3-42z1.AXS4.i686.rpm
MD5: 5cbfdd7f940311b04cf640807d02e211
SHA-256: 1856354f404841ed22c98b888fe54e2415c0762e9039a26c6643ba3f9150f0a8
Size: 157.71 kB - krb5-workstation-1.10.3-42z1.AXS4.i686.rpm
MD5: 448711f5c8035178cff25886a29cc00a
SHA-256: 1d95650491ee9b649dc3683df85f153b4a463860cf36c036c622fa6fae556239
Size: 807.97 kB
Asianux Server 4 for x86_64
- krb5-devel-1.10.3-42z1.AXS4.x86_64.rpm
MD5: 8ff841bfca6deab2401c897a9eadce80
SHA-256: f66fd0654561c2d99842b016fe5eea977812868bcc533b14a043c06e0e3c3d11
Size: 501.17 kB - krb5-libs-1.10.3-42z1.AXS4.x86_64.rpm
MD5: 3dda162c05252e06fe3908ef0132ab25
SHA-256: fc7026e8efc23d5f8e49641aeba4c82d40c4c54696f19a1bc4d2bf00a192af57
Size: 767.74 kB - krb5-pkinit-openssl-1.10.3-42z1.AXS4.x86_64.rpm
MD5: 747fe38c14750a15834e02d402875a7f
SHA-256: d5585ae1f1fba43c5a29834226347de19a79c5e746192bb17b27ecbc1db03fe1
Size: 123.71 kB - krb5-server-1.10.3-42z1.AXS4.x86_64.rpm
MD5: 856e3d2881339aa2b5e69b173f01675f
SHA-256: 92d9c363eb18436c96c0cbdfdac643ebf9b87b2c9264951adc4c80b0542661ec
Size: 1.99 MB - krb5-server-ldap-1.10.3-42z1.AXS4.x86_64.rpm
MD5: b970279cdec21eb4a84ca0bf288adc0e
SHA-256: 4af9576762e3153bc25fe8b5f9faac119df7f0c8813140558cd91059f42c9489
Size: 157.68 kB - krb5-workstation-1.10.3-42z1.AXS4.x86_64.rpm
MD5: db4919b90a236c3759aa07bbde6f014a
SHA-256: 20f839a21d1e26d19d41f6bbea8cae0a578591ffa3f723994ee18f1cb5149477
Size: 810.49 kB - krb5-devel-1.10.3-42z1.AXS4.i686.rpm
MD5: 6ee005c265e5c209ae1004de4ee11965
SHA-256: 9b69d2f5ed80d135ddd1dbecee746105a22dadcc663ec6673d13dd1f147d395d
Size: 500.37 kB - krb5-libs-1.10.3-42z1.AXS4.i686.rpm
MD5: 67e4fdb0efed77addcdb4124e72773dd
SHA-256: 4e283b0654993529e4dea9fbe46581ec05ca678951af328e3b23585d74845263
Size: 776.32 kB - krb5-server-ldap-1.10.3-42z1.AXS4.i686.rpm
MD5: 5cbfdd7f940311b04cf640807d02e211
SHA-256: 1856354f404841ed22c98b888fe54e2415c0762e9039a26c6643ba3f9150f0a8
Size: 157.71 kB
English