what you don't know can hurt you

Mandriva Linux Security Advisory 2008-209

Mandriva Linux Security Advisory 2008-209
Posted Oct 6, 2008
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory - Stéphane Bertin discovered a flaw in the pam_krb5 existing_ticket configuration option where, if enabled and using an existing credential cache, it was possible for a local user to gain elevated privileges by using a different, local user's credential cache. The updated packages have been patched to prevent this issue.

tags | advisory, local
systems | linux, mandriva
advisories | CVE-2008-3825
MD5 | 6c8c02e04058c8e9e9b7b397c121754e

Mandriva Linux Security Advisory 2008-209

Change Mirror Download

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:209
http://www.mandriva.com/security/
_______________________________________________________________________

Package : pam_krb5
Date : October 3, 2008
Affected: 2007.1, 2008.0, 2008.1
_______________________________________________________________________

Problem Description:

Stéphane Bertin discovered a flaw in the pam_krb5 existing_ticket
configuration option where, if enabled and using an existing credential
cache, it was possible for a local user to gain elevated privileges
by using a different, local user's credential cache (CVE-2008-3825).

The updated packages have been patched to prevent this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3825
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.1:
92901a92d669d10831a2357da8ac3ff8 2007.1/i586/pam_krb5-2.2.11-2.1mdv2007.1.i586.rpm
e8ba90e174669b8b43bf0bbf9c61831f 2007.1/SRPMS/pam_krb5-2.2.11-2.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
63e366f352ed36d5e6b7b87a84d25d33 2007.1/x86_64/pam_krb5-2.2.11-2.1mdv2007.1.x86_64.rpm
e8ba90e174669b8b43bf0bbf9c61831f 2007.1/SRPMS/pam_krb5-2.2.11-2.1mdv2007.1.src.rpm

Mandriva Linux 2008.0:
d5d6796b990f19316ee7a53d87745d63 2008.0/i586/pam_krb5-2.2.11-2.1mdv2008.0.i586.rpm
8b2d51b298306d43dfde2fe6f9cb0860 2008.0/SRPMS/pam_krb5-2.2.11-2.1mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
5cb8c3f5768cdc475bfa81e14244856b 2008.0/x86_64/pam_krb5-2.2.11-2.1mdv2008.0.x86_64.rpm
8b2d51b298306d43dfde2fe6f9cb0860 2008.0/SRPMS/pam_krb5-2.2.11-2.1mdv2008.0.src.rpm

Mandriva Linux 2008.1:
2d30041830c5c3db19a23e096a968426 2008.1/i586/pam_krb5-2.2.11-2.1mdv2008.1.i586.rpm
2d1f96e821e05ddba6ffe3d1cee2247b 2008.1/SRPMS/pam_krb5-2.2.11-2.1mdv2008.1.src.rpm

Mandriva Linux 2008.1/X86_64:
d07f560edf337af6279a888fd695aa49 2008.1/x86_64/pam_krb5-2.2.11-2.1mdv2008.1.x86_64.rpm
2d1f96e821e05ddba6ffe3d1cee2247b 2008.1/SRPMS/pam_krb5-2.2.11-2.1mdv2008.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFI5nytmqjQ0CJFipgRAsqfAJ9gUQ/XJ8nhzX294hQulpz0ULJtuwCZAV0K
y4avzIV2yDHQt6qdOPEh7Pc=
=IVkL
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

June 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    35 Files
  • 2
    Jun 2nd
    14 Files
  • 3
    Jun 3rd
    40 Files
  • 4
    Jun 4th
    22 Files
  • 5
    Jun 5th
    1 Files
  • 6
    Jun 6th
    1 Files
  • 7
    Jun 7th
    19 Files
  • 8
    Jun 8th
    14 Files
  • 9
    Jun 9th
    39 Files
  • 10
    Jun 10th
    20 Files
  • 11
    Jun 11th
    22 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close