SCIENTIFIC-LINUX-ERRATA Archives

July 2011

SCIENTIFIC-LINUX-ERRATA@LISTSERV.FNAL.GOV
Options: Use Monospaced Font
Show Text Part by Default
Show All Mail Headers

Message: [<< First] [< Prev] [Next >] [Last >>]
Topic: [<< First] [< Prev] [Next >] [Last >>]
Author: [<< First] [< Prev] [Next >] [Last >>]

Print Reply
Subject:
Security ERRATA Important: krb5-appl on SL6.x i386/x86_64
From:
Troy Dawson <[log in to unmask]>
Reply To:
Troy Dawson <[log in to unmask]>
Date:
Tue, 5 Jul 2011 16:26:44 -0500
Content-Type:
text/plain
Parts/Attachments:
text/plain (26 lines) 
Synopsis:	Important: krb5-appl security update
Issue date:	2011-07-05
CVE Names:	CVE-2011-1526

The krb5-appl packages provide Kerberos-aware telnet, ftp, rcp, rsh, and
rlogin clients and servers. While these have been replaced by tools such 
as OpenSSH in most environments, they remain in use in others.

It was found that gssftp, a Kerberos-aware FTP server, did not properly
drop privileges. A remote FTP user could use this flaw to gain 
unauthorized read or write access to files that are owned by the root 
group. (CVE-2011-1526)

SL 6.x

       SRPMS:
krb5-appl-1.0.1-2.el6_1.1.src.rpm
       i386:
krb5-appl-clients-1.0.1-2.el6_1.1.i686.rpm
krb5-appl-servers-1.0.1-2.el6_1.1.i686.rpm
       x86_64:
krb5-appl-clients-1.0.1-2.el6_1.1.x86_64.rpm
krb5-appl-servers-1.0.1-2.el6_1.1.x86_64.rpm

- Scientific Linux Development Team

ATOM RSS1 RSS2