Synopsis: Critical: krb5 security update Issue date: 2007-06-26 CVE Names: CVE-2007-2442 CVE-2007-2443 CVE-2007-2798 David Coffey discovered an uninitialized pointer free flaw in the RPC library used by kadmind. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash or potentially execute arbitrary code as root. (CVE-2007-2442) David Coffey also discovered an overflow flaw in the RPC library used by kadmind. On Scientific Linux, exploitation of this flaw is limited to a denial of service. A remote unauthenticated attacker who can access kadmind could trigger this flaw and cause kadmind to crash. (CVE-2007-2443) A stack buffer overflow flaw was found in kadmind. An authenticated attacker who can access kadmind could trigger this flaw and potentially execute arbitrary code on the Kerberos server. (CVE-2007-2798) SL 3.0.x SRPMS: krb5-1.2.7-66.src.rpm i386: krb5-devel-1.2.7-66.i386.rpm krb5-libs-1.2.7-66.i386.rpm krb5-server-1.2.7-66.i386.rpm krb5-workstation-1.2.7-66.i386.rpm x86_64: krb5-devel-1.2.7-66.x86_64.rpm krb5-libs-1.2.7-66.i386.rpm krb5-libs-1.2.7-66.x86_64.rpm krb5-server-1.2.7-66.x86_64.rpm krb5-workstation-1.2.7-66.x86_64.rpm -Connie Sieh -Troy Dawson