[yellowdog-updates] Yellow Dog Linux Security Advisory: YDU-20010810-2

Subject: [yellowdog-updates] Yellow Dog Linux Security Advisory: YDU-20010810-2
dburcaw@newhope.terraplex.com
Date: Fri Aug 10 2001 - 14:12:21 MDT

Yellow Dog Linux Security Announcement
--------------------------------------

Package: krb5
Issue Date: August 10, 2001
Priority: high
Advisory ID: YDU-20010810-2

1. Topic:

        Updated krb5 packages are available
        that fix security vulnerabilities.

2. Problem:

        "By exploiting buffer overflows in the krb5 server included in the
        krb5-workstation package, a remote attacker can obtain superuser privileges
        on a vulnerable host."
        (from Red Hat's security advisory)

3. Solution:

           a) Updating via yup...
           We suggest that you use the Yellow Dog Update Program (yup)
           to keep your system up-to-date. The following command(s) will
           automatically retrieve and install the fixed version of
           this update onto your system:

                   yup update krb5
                yup update krb5-devel
                yup update krb5-libs
                yup update krb5-server
                yup update krb5-workstation

           b) Updating manually...
           The update can also be retrieved manually from our ftp site
           below along with the rpm command that should be used to install
           the update. (Please use a mirror site)

                   ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.0/ppc/RPMS/
                rpm -Fvh krb5-1.2.2-12.ppc.rpm
                rpm -Fvh krb5-devel-1.2.2-12.ppc.rpm
                rpm -Fvh krb5-libs-1.2.2-12.ppc.rpm
                rpm -Fvh krb5-server-1.2.2-12.ppc.rpm
                rpm -Fvh krb5-workstation-1.2.2-12.ppc.rpm

4. Verification

MD5 checksum Package
-------------------------------- ----------------------------
202486ff707114b2b1e61e30cabe6ef0 SRPMS/krb5-1.2.2-12.src.rpm
33884fd0d60d160c484a4860c339e9fc ppc/RPMS/krb5-devel-1.2.2-12.ppc.rpm
113844c322ff6ec554f122bf04d77bdd ppc/RPMS/krb5-libs-1.2.2-12.ppc.rpm
5901fd32ba8cba72017249f3026f9a95 ppc/RPMS/krb5-server-1.2.2-12.ppc.rpm
e5bcff59fe8741f21bad4ad3faf4e187 ppc/RPMS/krb5-workstation-1.2.2-12.ppc.rpm

If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename

5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of yup, the Yellow Dog Update Program, see
http://devel.yellowdoglinux.com/rp_yup.shtml

This archive was generated by hypermail 2a24 : Fri Aug 10 2001 - 14:25:23 MDT