|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
OpenBSD Information for VU#623217
| Date Notified: | 2003-03-05 |
| Date Updated: | |
| Statement Date: | |
| Status Summary: | Vulnerable |
Vendor StatementThere is a cryptographic weaknesses in the Kerberos v4 protocol
(this is not something that is fixable in Kerberos v4). Sites still
using Kerberos v4 should migrate to Kerberos v5.
Kerberos v5 does not have this weakness, but since it contains v4
to v5 translation services it is still possible to exploit the v4
protocol defect.
For more information, please see:
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-004-krb4.txt
The following patches cause Kerberos v4 requests from foreign realms
to be ignored unless support for this is explicitly enabled.
Patch for OpenBSD 3.1:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/026_kerberos.patch
Patch for OpenBSD 3.2:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/013_kerberos.patch
The aforementioned patches have already been applied to the 3.1 and
3.2 -stable branches.Vendor InformationThe vendor has not provided us with any further information regarding this vulnerability.
AddendumThe CERT/CC has no additional comments at this time.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
