[El-errata] ELSA-2007-0095 Critical: Enterprise Linux 3 krb5 security update

[el-errata at oss.oracle.com]

Enterprise Linux Security Advisory ELSA-2007-0095

https://rhn.redhat.com/errata/RHSA-2007-0095.html

The following updated rpms for Enterprise Linux 3 have been uploaded to the Unbreakable Linux Network:

i386:
krb5-devel-1.2.7-61.i386.rpm
krb5-libs-1.2.7-61.i386.rpm
krb5-server-1.2.7-61.i386.rpm
krb5-workstation-1.2.7-61.i386.rpm

x86_64: 
krb5-devel-1.2.7-61.x86_64.rpm
krb5-libs-1.2.7-61.i386.rpm
krb5-libs-1.2.7-61.x86_64.rpm
krb5-server-1.2.7-61.x86_64.rpm
krb5-workstation-1.2.7-61.x86_64.rpm


SRPMS:

http://oss.oracle.com/el3/SRPMS-updates/krb5-1.2.7-61.src.rpm

Description of changes:

[1.2.7-61]
- fix bug ID in changelog

[1.2.7-60]
- add preliminary patch to fix buffer overflow in krb5kdc and kadmind
  (#231528, CVE-2007-0957)
- add preliminary patch to fix double-free in kadmind (#231537, CVE-2007-1216)

[1.2.7-59]
- add preliminary patch to correct unauthorized access via krb5-aware telnet
  daemon (#229782, CVE-2007-0956)
- update to revised upstream patches for CVE-2006-3083 and CVE-2006-3084
  (MITKRB5-SA-2006-001) to avoid unnecessary error messages from ksu (#209512)

[1.2.7-58]
- temporarily back out changes for #193871
- apply patch to fix unchecked calls to setuid() (CVE-2006-3083) and
  seteuid() (CVE-2006-3084) (#197818)

[1.2.7-57]
- allow the tickets to be encrypted with either the session key or subsession
  key, as later releases do (#193871)