Ubuntu Security Notices
USN-477-1

USN-477-1: krb5 vulnerabilities

Publication date

27 June 2007

Overview

krb5 vulnerabilities

Releases

Details

Wei Wang discovered that the krb5 RPC library did not correctly handle
certain error conditions. A remote attacker could cause kadmind to free
an uninitialized pointer, leading to a denial of service or possibly
execution of arbitrary code with root privileges. (CVE-2007-2442)

Wei Wang discovered that the krb5 RPC library did not correctly check
the size of certain communications. A remote attacker could send a
specially crafted request to kadmind and execute arbitrary code with
root privileges. (CVE-2007-2443)

It was discovered that the kadmind service could be made to overflow its
stack. A remote attacker could send a specially crafted request and
execute arbitrary code with root privileges. (CVE-2007-2798)

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
7.04 feisty	libkadm55 – 1.4.4-5ubuntu3.1
6.10 edgy	libkadm55 – 1.4.3-9ubuntu1.3
6.06 dapper	libkadm55 – 1.4.3-5ubuntu0.4

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

USN-477-1: krb5 vulnerabilities

Details

Update instructions

Reduce your security exposure

References