Issued:

2011-05-19

Updated:

2011-05-19

RHBA-2011:0571 - krb5 bugfix update

Synopsis

krb5 bugfix update

Type/Severity

Bug Fix Advisory

Topic

Updated krb5 packages that fix multiple bugs are now available for Red Hat Enterprise Linux 6.

Description

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).

Kerberos has been upgraded to version 1.9, which provides a number of bug fixes over the previous version. (BZ#642417)

This update fixes the following bugs:

• Previously, no IPv6 suport was available for kprop, kpropd, kadmin and kadmind. This update adds IPv6 support to these utilities. (BZ#595841, BZ#595842)

• Previously, the krbPwdExpiration attribute in the principal's entry would often be ignored when the realm database was stored in a directory server. This update fixes this problem and this attribute is no longer ignored. (BZ#627039)

• Previously, kinit with smart card login did not authenticate to the KDC correctly if the certificate on the smart card did not contain a subjectAltName extension or multiple certificates were available and krb5.conf was configured to select according to the value of the keyUsage extension in the certificates. This update continues to look for certificates with the right extension and corrects the valuation. (BZ#629022)

• Previously, the init script for the kpropd was not Linux Standards Base (LSB) compliant. With this update, this init script is LSB compliant. (BZ#630587)

• Previously, the KDC log files were not rotated by default. This update corrects this problem. Now these log files are rotated correctly. (BZ#630968)

• Previously, logins failed if the user had a .k5login file which did not explicitly contain the user's principal name. With this update, this check can be disabled using the "k5login_authoritative" setting in krb5.conf. (BZ#646499)

• Previously, GSSAPI authentication from Windows clients using cross-realm authentication failed if the client's ticket included a Privilege Attribute Certificate (PAC) with a failed signature check. Failed signature checks are now ignored. (BZ#679612)

All krb5 users are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at This content is not included.https://access.redhat.com/kb/docs/DOC-11259/

Affected Products

Updated Packages

• krb5-debuginfo-1.9-9.el6.s390x.rpm
• krb5-libs-1.9-9.el6.ppc.rpm
• krb5-libs-1.9-9.el6.ppc64.rpm
• krb5-pkinit-openssl-1.9-9.el6.ppc64.rpm
• krb5-pkinit-openssl-1.9-9.el6.x86_64.rpm
• krb5-server-ldap-1.9-9.el6.i686.rpm
• krb5-devel-1.9-9.el6.ppc64.rpm
• krb5-workstation-1.9-9.el6.s390x.rpm
• krb5-libs-1.9-9.el6.s390.rpm
• krb5-server-1.9-9.el6.i686.rpm
• krb5-devel-1.9-9.el6.s390.rpm
• krb5-debuginfo-1.9-9.el6.x86_64.rpm
• krb5-devel-1.9-9.el6.s390x.rpm
• krb5-debuginfo-1.9-9.el6.ppc.rpm
• krb5-server-ldap-1.9-9.el6.s390.rpm
• krb5-libs-1.9-9.el6.i686.rpm
• krb5-pkinit-openssl-1.9-9.el6.i686.rpm
• krb5-server-1.9-9.el6.x86_64.rpm
• krb5-libs-1.9-9.el6.s390x.rpm
• krb5-server-1.9-9.el6.s390x.rpm
• krb5-devel-1.9-9.el6.x86_64.rpm
• krb5-devel-1.9-9.el6.i686.rpm
• krb5-server-ldap-1.9-9.el6.ppc64.rpm
• krb5-debuginfo-1.9-9.el6.ppc64.rpm
• krb5-workstation-1.9-9.el6.x86_64.rpm
• krb5-debuginfo-1.9-9.el6.i686.rpm
• krb5-server-ldap-1.9-9.el6.ppc.rpm
• krb5-server-ldap-1.9-9.el6.s390x.rpm
• krb5-1.9-9.el6.src.rpm
• krb5-workstation-1.9-9.el6.ppc64.rpm
• krb5-pkinit-openssl-1.9-9.el6.s390x.rpm
• krb5-server-1.9-9.el6.ppc64.rpm
• krb5-libs-1.9-9.el6.x86_64.rpm
• krb5-workstation-1.9-9.el6.i686.rpm
• krb5-server-ldap-1.9-9.el6.x86_64.rpm
• krb5-devel-1.9-9.el6.ppc.rpm
• krb5-debuginfo-1.9-9.el6.s390.rpm

Fixes

• This content is not included.BZ - 595841
• This content is not included.BZ - 595842
• This content is not included.BZ - 627039
• This content is not included.BZ - 629022
• This content is not included.BZ - 630968
• This content is not included.BZ - 636985
• This content is not included.BZ - 642417
• This content is not included.BZ - 646499

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.