RHEL 4 : krb5 (RHSA-2006:0612)
High Nessus Plugin ID 22201
SynopsisThe remote Red Hat host is missing one or more security updates.
DescriptionUpdated krb5 packages are now available for Red Hat Enterprise Linux 4 to correct a privilege escalation security flaw.
This update has been rated as having important security impact by the Red Hat Security Response Team.
Kerberos is a network authentication system which allows clients and servers to authenticate to each other through use of symmetric encryption and a trusted third party, the KDC.
A flaw was found where some bundled Kerberos-aware applications would fail to check the result of the setuid() call. On Linux 2.6 kernels, the setuid() call can fail if certain user limits are hit. A local attacker could manipulate their environment in such a way to get the applications to continue to run as root, potentially leading to an escalation of privileges. (CVE-2006-3083).
Users are advised to update to these erratum packages which contain a backported fix to correct this issue.
SolutionUpdate the affected packages.