U programskom paketu krb5 otkrivene su dvije sigurnosne ranjivosti koje udaljeni zlonamjerni korisnici mogu iskoristiti za zaobilaženje postavljenih ograničenja, izmjenu podataka, otkrivanje osjetljivih informacija te proizvoljno izvršavanje programskog koda.

   openSUSE Security Update: krb5-appl: Fixed remote buffer overflow in
ktelnetd
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2012:0051-1
Rating:             important
References:         #698471 #738632 
Cross-References:   CVE-2011-4862
Affected Products:
                    openSUSE 11.4
                    openSUSE 11.3
______________________________________________________________________________

   An update that solves one vulnerability and has one errata
   is now available.

Description:

   This update of krb5 applications fixes two security issues.

   CVE-2011-4862: A remote code execution in the kerberized
   telnet daemon was fixed. (This only affects the ktelnetd
   from the krb5-appl RPM, not the regular telnetd supplied by
   SUSE.)

   CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd
   unauthorized file access problems.


Patch Instructions:

   To install this openSUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - openSUSE 11.4:

      zypper in -t patch krb5-appl-5593

   - openSUSE 11.3:

      zypper in -t patch krb5-appl-5593

   To bring your system up-to-date, use "zypper patch".


Package List:

   - openSUSE 11.4 (i586 x86_64):

      krb5-appl-clients-1.0-7.12.1
      krb5-appl-servers-1.0-7.12.1

   - openSUSE 11.3 (i586 x86_64):

      krb5-appl-clients-1.0-4.5.1
      krb5-appl-servers-1.0-4.5.1


References:

   http://support.novell.com/security/cve/CVE-2011-4862.html
   https://bugzilla.novell.com/698471
   https://bugzilla.novell.com/738632

-- 
To unsubscribe, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
For additional commands, e-mail: Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.