SUSE Security Update: Security update for krb5
______________________________________________________________________________

Announcement ID:    SUSE-SU-2012:0042-1
Rating:             important
References:         #596826 #650650 #698471 #738632 
Cross-References:   CVE-2011-4862
Affected Products:
                    SUSE Linux Enterprise Server 10 SP2
______________________________________________________________________________

   An update that solves one vulnerability and has three fixes
   is now available.

Description:


   This update of krb5 fixes several security issues.

   * CVE-2011-4862: A remote code execution in the
   kerberized telnet daemon was fixed. (This only affects the
   ktelnetd from the krb5-appl RPM, not the regular telnetd
   supplied by SUSE.)
   * CVE-2011-1526 / MITKRB5-SA-2011-005: Fixed krb5 ftpd
   unauthorized file access problems.
   * CVE-2010-1323 / MITKRB5-SA-2010-007: Fixed multiple
   checksum handling vulnerabilities, where: o krb5 clients
   might have accepted unkeyed SAM-2 challenge checksums o
   krb5 might have accepted KRB-SAFE checksums with
   low-entropy derived keys
   * CVE-2010-1321, MITKRB5-SA-2010-005: Fixed GSS-API
   library null pointer dereference

   Security Issue reference:

   * CVE-2011-4862
   

Indications:

   Please install this update.


Package List:

   - SUSE Linux Enterprise Server 10 SP2 (i586 s390x x86_64):

      krb5-1.4.3-19.43.37.1
      krb5-apps-clients-1.4.3-19.43.37.1
      krb5-apps-servers-1.4.3-19.43.37.1
      krb5-client-1.4.3-19.43.37.1
      krb5-devel-1.4.3-19.43.37.1
      krb5-server-1.4.3-19.43.37.1

   - SUSE Linux Enterprise Server 10 SP2 (s390x x86_64):

      krb5-32bit-1.4.3-19.43.37.1
      krb5-devel-32bit-1.4.3-19.43.37.1


References:

   https://www.suse.com/security/cve/CVE-2011-4862.html
   https://bugzilla.novell.com/596826
   https://bugzilla.novell.com/650650
   https://bugzilla.novell.com/698471
   https://bugzilla.novell.com/738632
   https://login.microfocus.com/nidp/app/login