Scientific Linux Security Update : krb5 on SL5.x i386/x86_64

This script is Copyright (C) 2012-2013 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

A NULL pointer dereference flaw was found in the way the MIT Kerberos
KDC processed principal names that were not null terminated, when the
KDC was configured to use an LDAP back end. A remote attacker could
use this flaw to crash the KDC via a specially-crafted request.
(CVE-2011-0282)

A denial of service flaw was found in the way the MIT Kerberos KDC
processed certain principal names when the KDC was configured to use
an LDAP back end. A remote attacker could use this flaw to cause the
KDC to hang via a specially-crafted request. (CVE-2011-0281)

After installing the updated packages, the krb5kdc daemon will be
restarted automatically.

See also :

http://www.nessus.org/u?6ed1a259

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 60952 ()

Bugtraq ID:

CVE ID: CVE-2011-0281
CVE-2011-0282