patches available for the Kerberos v4 protocol bug
"Todd C. Miller" <[email protected]>
| Newsgroups | gmane.os.openbsd.security.announce |
|---|---|
| Message-ID | <[email protected]> |
There is a cryptographic weaknesses in the Kerberos v4 protocol
(this is not something that is fixable in Kerberos v4). Sites still
using Kerberos v4 should migrate to Kerberos v5.
Kerberos v5 does not have this weakness, but since it contains v4
to v5 translation services it is still possible to exploit the v4
protocol defect.
For more information, please see:
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2003-004-krb4.txt
The following patches cause Kerberos v4 requests from foreign realms
to be ignored unless support for this is explicitly enabled.
Patch for OpenBSD 3.1:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.1/common/026_kerberos.patch
Patch for OpenBSD 3.2:
ftp://ftp.openbsd.org/pub/OpenBSD/patches/3.2/common/013_kerberos.patch
The aforementioned patches have already been applied to the 3.1 and
3.2 -stable branches.