DSA-273-1 krb4 -- криптографическая слабость

Высокая (7.5)

(AV:N/AC:L/Au:N/C:P/I:P/A:P)

Debian

kerberos4kth1 (any) kerberos4kth-clients (any) kerberos4kth-clients-x (any) kerberos4kth-dev (any) kerberos4kth-dev-common (any) kerberos4kth-docs (any) kerberos4kth-kdc (any) kerberos4kth-kip (any) kerberos4kth-servers (any) kerberos4kth-servers-x (any) kerberos4kth-services (any) kerberos4kth-user (any) kerberos4kth-x11 (any) libacl1-kerberos4kth (any) libkadm1-kerberos4kth (any) libkdb-1-kerberos4kth (any) libkrb-1-kerberos4kth (any)

Криптографическая слабость 4 версии протокола Kerberos позволяет
нападающему использовать атаку на подбор текста, чтобы выдать себя за
любой авторитетный источник. Другие уязвимые места реализации krb4,
включённой в дистрибутив krb4 MIT, позволяют использовать атаку
"вырезать и вставить" для изготовления билетов krb4 неавторизованных
клиентов-авторитетных источников, если сервер krb4 использует ключи
3DES. Эти атаки могут подорвать всю инфраструктуру аутентификации на
основе Kerberos сайта.
В стабильном дистрибутиве (woody) эта проблема исправлена
в версии 1.1-8-2.3.
В старом стабильном дистрибутиве (potato) эта проблема исправлена
в версии 1.0-2.3.
В нестабильном дистрибутиве (sid) эта проблема исправлена
в версии 1.2.2-1.
Мы рекомендуем вам немедленно обновить пакет krb4.

Проблема может быть решена обновлением операционной системы до следующих версий пакетов в зависимости от архитектуры:
Debian GNU/Linux 3.0:
ppc:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
s390x:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
m68k:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
i686:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
hppa:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
sparc:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
alpha:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
ia64:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
mips:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
noarch:
kerberos4kth-docs - 1.1-8-2.3
kerberos4kth-services - 1.1-8-2.3
kerberos4kth-user - 1.1-8-2.3
kerberos4kth-x11 - 1.1-8-2.3
kerberos4kth1 - 1.1-8-2.3
mipsel:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
arm:
kerberos4kth-clients - 1.1-8-2.3
kerberos4kth-clients-x - 1.1-8-2.3
kerberos4kth-dev - 1.1-8-2.3
kerberos4kth-dev-common - 1.1-8-2.3
kerberos4kth-kdc - 1.1-8-2.3
kerberos4kth-kip - 1.1-8-2.3
kerberos4kth-servers - 1.1-8-2.3
kerberos4kth-servers-x - 1.1-8-2.3
libacl1-kerberos4kth - 1.1-8-2.3
libkadm1-kerberos4kth - 1.1-8-2.3
libkdb-1-kerberos4kth - 1.1-8-2.3
libkrb-1-kerberos4kth - 1.1-8-2.3
Debian GNU/Linux 2.2:
alpha:
kerberos4kth-clients - 1.0-2.3
kerberos4kth-dev - 1.0-2.3
kerberos4kth-kdc - 1.0-2.3
kerberos4kth-services - 1.0-2.3
kerberos4kth-user - 1.0-2.3
kerberos4kth-x11 - 1.0-2.3
kerberos4kth1 - 1.0-2.3
sparc:
kerberos4kth-clients - 1.0-2.3
kerberos4kth-dev - 1.0-2.3
kerberos4kth-kdc - 1.0-2.3
kerberos4kth-services - 1.0-2.3
kerberos4kth-user - 1.0-2.3
kerberos4kth-x11 - 1.0-2.3
kerberos4kth1 - 1.0-2.3
arm:
kerberos4kth-clients - 1.0-2.3
kerberos4kth-dev - 1.0-2.3
kerberos4kth-kdc - 1.0-2.3
kerberos4kth-services - 1.0-2.3
kerberos4kth-user - 1.0-2.3
kerberos4kth-x11 - 1.0-2.3
kerberos4kth1 - 1.0-2.3
m68k:
kerberos4kth-clients - 1.0-2.2
kerberos4kth-dev - 1.0-2.2
kerberos4kth-kdc - 1.0-2.2
kerberos4kth-services - 1.0-2.2
kerberos4kth-user - 1.0-2.2
kerberos4kth-x11 - 1.0-2.2
kerberos4kth1 - 1.0-2.2
i686:
kerberos4kth-clients - 1.0-2.3
kerberos4kth-dev - 1.0-2.3
kerberos4kth-kdc - 1.0-2.3
kerberos4kth-services - 1.0-2.3
kerberos4kth-user - 1.0-2.3
kerberos4kth-x11 - 1.0-2.3
kerberos4kth1 - 1.0-2.3

http://www.debian.org/security/dsa-273/

Источник: CVE
Наименование: CVE-2003-0138
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0138

Источник: CVE
Наименование: CVE-2003-0139
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0139