=========================================================== Ubuntu Security Notice USN-719-1 February 12, 2009 libpam-krb5 vulnerabilities CVE-2009-0360, CVE-2009-0361 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 8.04 LTS Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.04 LTS: libpam-krb5 3.10-1ubuntu0.8.04.1 Ubuntu 8.10: libpam-krb5 3.10-1ubuntu0.8.10.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that pam_krb5 parsed environment variables when run with setuid applications. A local attacker could exploit this flaw to bypass authentication checks and gain root privileges. (CVE-2009-0360) Derek Chan discovered that pam_krb5 incorrectly handled refreshing existing credentials when used with setuid applications. A local attacker could exploit this to create or overwrite arbitrary files, and possibly gain root privileges. (CVE-2009-0361) Updated packages for Ubuntu 8.04 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1.diff.gz Size/MD5: 12322 2915d0d5b4133bcc65b6bc03346033b0 http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1.dsc Size/MD5: 816 cbc0e2b13d48682ec29127649d9d3407 http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10.orig.tar.gz Size/MD5: 156259 6ec6bd6637f8c91bf5386ed95fa975ba amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_amd64.deb Size/MD5: 78068 6f201eda9f6df9d527c165c21756084d i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_i386.deb Size/MD5: 77412 199ba52d9440d89f70fab1544fa90d7f lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_lpia.deb Size/MD5: 77246 ff9cce0bbaf03a1a348fcd1fb0ca6745 powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_powerpc.deb Size/MD5: 80536 e3ec20dbf0fb9666549f801c012f72b0 sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.04.1_sparc.deb Size/MD5: 77196 6e8a12a640e6c9163d65709d68c14775 Updated packages for Ubuntu 8.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1.diff.gz Size/MD5: 12322 9646c596627edf91af8799f78b9bffb2 http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1.dsc Size/MD5: 1234 39b9545e294f6937092fbf8316ffc9d1 http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10.orig.tar.gz Size/MD5: 156259 6ec6bd6637f8c91bf5386ed95fa975ba amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_amd64.deb Size/MD5: 78348 9be5305e9bb4f8b85d0857230cc2acda i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_i386.deb Size/MD5: 77494 2e37aba551e192fffaf17754b96fee1a lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_lpia.deb Size/MD5: 77452 d89fdc271a18c000d84a2ce6c1c1db4a powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_powerpc.deb Size/MD5: 80632 5312557a64d26867ac5472ee56f3ac2e sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/libp/libpam-krb5/libpam-krb5_3.10-1ubuntu0.8.10.1_sparc.deb Size/MD5: 76978 9fc7e9ee619bd7ce77fafe13a2dc46b8