Issued:
2013-01-07
Updated:
2013-01-07

RHBA-2013:0078 - mod_auth_kerb bug fix and enhancement update

Synopsis

mod_auth_kerb bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated mod_auth_kerb packages that fix two bugs and add one enhancement are now available for Red Hat Enterprise Linux 5.

Description

The mod_auth_kerb package provides a module for the Apache HTTP Server designed to provide Kerberos authentication over HTTP. The module supports the Negotiate authentication method, which performs full Kerberos authentication based on ticket exchanges.

These updated mod_auth_kerb packages provide fixes for the following bugs:

  • Prior to this update, the mod_auth_kerb source RPM could not be built by a non-root user. This was because the httpd-devel package places the apxs utility, which is needed to build the mod_auth_kerb package, into the /usr/sbin directory. This directory is not specified in the PATH variable for non-root users. With this update, the apxs utility is defined as being placed in the /usr/bin directory in the "mod_auth_kerb.spec" file, and the mod_auth_kerb SRPM can now be successfully built by non-root users. (BZ#456662)

  • The "mod_auth_kerb" module did not use the Kerberos libraries in a thread-safe way. Therefore, if mod_auth_kerb ran under a multi-threaded Apache HTTP Server, authentication requests could terminate unexpectedly with a segmentation fault. With this update, the thread-safety problem has been fixed, and crashes no longer occur under these circumstances. (BZ#734098)

In addition, these updated mod_auth_kerb packages provide the following enhancement:

  • The "KrbLocalUserMapping" Apache directive has been added to allow Kerberos principal names to be mapped to system user names. (BZ#446670)

Users are advised to upgrade to these updated mod_auth_kerb packages, which fix these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

ProductVersionArch
Red Hat Enterprise Linux for Power, big endian5ppc
Red Hat Enterprise Linux for IBM z Systems5s390x
Red Hat Enterprise Linux Workstation5x86_64
Red Hat Enterprise Linux Workstation5i386
Red Hat Enterprise Linux Server5x86_64
Red Hat Enterprise Linux Server5ia64
Red Hat Enterprise Linux Server5i386
Red Hat Enterprise Linux Server from RHUI5x86_64
Red Hat Enterprise Linux Server from RHUI5i386

Updated Packages

  • mod_auth_kerb-debuginfo-5.1-5.el5.s390x.rpm
  • mod_auth_kerb-debuginfo-5.1-5.el5.ia64.rpm
  • mod_auth_kerb-debuginfo-5.1-5.el5.i386.rpm
  • mod_auth_kerb-debuginfo-5.1-5.el5.x86_64.rpm
  • mod_auth_kerb-debuginfo-5.1-5.el5.ppc.rpm
  • mod_auth_kerb-5.1-5.el5.i386.rpm
  • mod_auth_kerb-5.1-5.el5.ia64.rpm
  • mod_auth_kerb-5.1-5.el5.s390x.rpm
  • mod_auth_kerb-5.1-5.el5.x86_64.rpm
  • mod_auth_kerb-5.1-5.el5.src.rpm
  • mod_auth_kerb-5.1-5.el5.ppc.rpm

Fixes

CVEs

(none)

References

(none)

Additional information