Issued:

2013-02-20

Updated:

2013-02-20

RHBA-2013:0319 - krb5 bug fix update

Synopsis

krb5 bug fix update

Type/Severity

Bug Fix Advisory

Topic

Updated krb5 packages that fix several bugs are now available for Red Hat Enterprise Linux 6.

Description

Kerberos is a network authentication system which allows clients and servers to authenticate to each other using symmetric encryption and a trusted third-party, the Key Distribution Center (KDC).

The krb5 packages have been upgraded to upstream version 1.10.3, which provides a number of bug fixes over the previous version, including better support of cross-domain trust functionality in other packages. (BZ#823926)

This update fixes the following bugs:

• Older versions of the libsmbclient package incorrectly depended on the krb5_locate_kdc() function, which is no longer supported. Consequently, applications which used older versions of libsmbclient became incompatible after the Kerberos library update. With this update, an explicit conflict with older versions of libsmbclient has been added. As a result, an incompatible combination cannot be installed. (BZ#771687)

• Previously, when the krb5-auth-dialog application was used and the prompter was left hanging for a long period of time, a large clock skew was mistakenly recorded. This clock drift was applied in the next kinit session. Consequently, the klist function reported an incorrect expiration time. This bug has been fixed, and the spurious time offset no longer occurs in the described scenario. (BZ#773496)

• Previously, when a list of trusted roots of a PKINIT client included the KDC's certificates, certain KDC implementations omitted such anchors from the list of certificates in the signed data structure. Consequently, the client failed to verify the KDC's signature on the signed data. With this update, a backported fix has been included to allow the client to use its own copies of relevant certificates. As a result, the verification no longer fails in the aforementioned scenario. (BZ#834718)

• Prior to this update, attempts to use the kinit command with a keytab file often failed when the keytab file did not contain the Advanced Encryption Standard (AES) keys, but the client's libraries and the KDC both supported AES. The strongest supported encryption type (AES) was chosen by default, even though it was not present in keytab. Consequently, a mismatch error occurred. The bug has been fixed, and keytabs containing any of the supported encryption types are now correctly processed. (BZ#837855)

• Previously, the krb5 package did not handle the timeout variable properly. In certain cases, the timeout variable became a negative number. Consequently, the client entered a loop while checking for responses. With this update, the client logic has been modified and the described error no longer occurs. (BZ#838548)

• Prior to this update, the passwd utility failed when used by an Identity Management client. Consequently, an error occurred with the following message:

  token manipulation error

The bug has been fixed, and the passwd utility now works with Identity Management as expected. (BZ#839017)

• Due to a previous update to a locally-applied patch, files created by the libkrb5 library were given correct SELinux labels. However, each flushing of the replay cache caused the file context configuration to be reloaded to ensure that the correct label is applied to the newly-created replacement replay cache file. This resulted in large performance degradation in applications which accept authentication and use replay caches. With this update, the context configuration is only loaded when the context configuration file has been modified and the configuration is now freed only when the library is unloaded or the calling application exits, thus greatly lowering the impact of this problem. (BZ#845125, BZ#846472)

All users of krb5 are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Updated Packages

• krb5-pkinit-openssl-1.10.3-10.el6.i686.rpm
• krb5-devel-1.10.3-10.el6.x86_64.rpm
• krb5-workstation-1.10.3-10.el6.x86_64.rpm
• krb5-pkinit-openssl-1.10.3-10.el6.s390x.rpm
• krb5-server-ldap-1.10.3-10.el6.i686.rpm
• krb5-debuginfo-1.10.3-10.el6.ppc64.rpm
• krb5-libs-1.10.3-10.el6.ppc64.rpm
• krb5-libs-1.10.3-10.el6.s390.rpm
• krb5-debuginfo-1.10.3-10.el6.i686.rpm
• krb5-devel-1.10.3-10.el6.s390x.rpm
• krb5-server-1.10.3-10.el6.x86_64.rpm
• krb5-debuginfo-1.10.3-10.el6.s390.rpm
• krb5-libs-1.10.3-10.el6.ppc.rpm
• krb5-pkinit-openssl-1.10.3-10.el6.ppc64.rpm
• krb5-server-ldap-1.10.3-10.el6.s390.rpm
• krb5-server-1.10.3-10.el6.s390x.rpm
• krb5-libs-1.10.3-10.el6.i686.rpm
• krb5-server-ldap-1.10.3-10.el6.s390x.rpm
• krb5-1.10.3-10.el6.src.rpm
• krb5-server-1.10.3-10.el6.ppc64.rpm
• krb5-debuginfo-1.10.3-10.el6.s390x.rpm
• krb5-server-1.10.3-10.el6.i686.rpm
• krb5-workstation-1.10.3-10.el6.ppc64.rpm
• krb5-debuginfo-1.10.3-10.el6.ppc.rpm
• krb5-devel-1.10.3-10.el6.i686.rpm
• krb5-devel-1.10.3-10.el6.ppc.rpm
• krb5-devel-1.10.3-10.el6.ppc64.rpm
• krb5-server-ldap-1.10.3-10.el6.x86_64.rpm
• krb5-libs-1.10.3-10.el6.s390x.rpm
• krb5-server-ldap-1.10.3-10.el6.ppc64.rpm
• krb5-pkinit-openssl-1.10.3-10.el6.x86_64.rpm
• krb5-workstation-1.10.3-10.el6.s390x.rpm
• krb5-server-ldap-1.10.3-10.el6.ppc.rpm
• krb5-libs-1.10.3-10.el6.x86_64.rpm
• krb5-devel-1.10.3-10.el6.s390.rpm
• krb5-workstation-1.10.3-10.el6.i686.rpm
• krb5-debuginfo-1.10.3-10.el6.x86_64.rpm

Fixes

• This content is not included.BZ - 771687
• This content is not included.BZ - 773496
• This content is not included.BZ - 823926
• This content is not included.BZ - 834718
• This content is not included.BZ - 837855
• This content is not included.BZ - 845125
• This content is not included.BZ - 846472
• This content is not included.BZ - 871524

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.