<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
<tt>Oracle VM Security Advisory OVMSA-2009-0003<br>
<br>
The following updated rpms for Oracle VM 2.1 have been uploaded to the
Unbreakable Linux Network:<br>
<br>
i386:<br>
krb5-libs-1.6.1-31.el5_3.3.i386.rpm<br>
krb5-server-1.6.1-31.el5_3.3.i386.rpm<br>
krb5-workstation-1.6.1-31.el5_3.3.i386.rpm<br>
<br>
<br>
SRPMS:<br>
<a class="moz-txt-link-freetext"
href="http://oss.oracle.com/oraclevm/server/SRPMS-updates/krb5-1.6.1-31.el5_3.3.src.rpm">http://oss.oracle.com/oraclevm/server/SRPMS-updates/krb5-1.6.1-31.el5_3.3.src.rpm</a><br>
<br>
<br>
Description of changes:<br>
<br>
Following security fixes are released in this errata:<br>
<br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0844">CVE-2009-0844</a><br>
</tt> <tt>The get_input_token function in the SPNEGO implementation
in MIT
Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote attackers to
cause a denial of service (daemon crash) and possibly obtain
sensitive
information via a crafted length value that triggers a buffer
over-read.<br>
<br>
</tt><tt><a
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0845">CVE-2009-0845</a><br>
The spnego_gss_accept_sec_context function in
lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5
through 1.6.3, when SPNEGO is used, allows remote attackers to cause a
denial of service (NULL pointer dereference and daemon crash) via
invalid ContextFlags data in the reqFlags field in a negTokenInit
token.</tt><br>
<tt><br>
<a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0846">CVE-2009-0846</a><br>
The asn1_decode_generaltime function in lib/krb5/asn.1/asn1_decode.c
in the ASN.1 GeneralizedTime decoder in MIT Kerberos 5 (aka krb5)
before 1.6.4 allows remote attackers to cause a denial of service
(daemon crash) or possibly execute arbitrary code via vectors
involving an invalid DER encoding that triggers a free of an
uninitialized pointer.</tt><br>
<tt><br>
[1.6.1-31.el5_3.3]<br>
- update to revised patch for CVE-2009-0844/CVE-2009-0845<br>
<br>
[1.6.1-31.el5_3.2]<br>
- add fix for potential buffer read overrun in the SPNEGO GSSAPI
mechanism<br>
(#490635, CVE-2009-0844)<br>
- add fix for NULL pointer dereference when handling certain error cases<br>
in the SPNEGO GSSAPI mechanism (#490635, CVE-2009-0845)<br>
- add fix for attempt to free uninitialized pointer in the ASN.1 decoder<br>
(#490635, CVE-2009-0846)<br>
- add fix for bug in length validation in the ASN.1 decoder
(CVE-2009-0847)<br>
<br>
[1.6.1-31.el5_3.1]<br>
- add backport of svn patch to fix a bug in how the gssapi library<br>
handles certain error cases in gss_accept_sec_context (CVE-2009-0845,<br>
<br>
[1.6.1-31.el5_3]<br>
- add a backported patch which adds a check on credentials obtained from<br>
a foreign realm to make sure that they're of an acceptable type, and<br>
if not, retry to the request to get one of the right type (Sadique
Puthen,<br>
<br>
[1.6.1-30.el5_3]<br>
- backport fix from 1.6.3 to register file-based ccaches created with<br>
the krb5_cc_new_unique() function with the global list, so that we<br>
don't crash when we go to close the ccache (#468729)<br>
<br>
</tt>
</body>
</html>