[ MDVSA-2009:082 ] krb5

[dude67]

_______________________________________________________________________

Package : krb5
Date : March 30, 2009
Affected: 2008.0, 2008.1, 2009.0
_______________________________________________________________________

Problem Description:

The spnego_gss_accept_sec_context function in
lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.6.3,
when SPNEGO is used, allows remote attackers to cause a denial of
service (NULL pointer dereference and application crash) via invalid
ContextFlags data in the reqFlags field in a negTokenInit token
(CVE-2009-0845).

This update provides the fix for that security issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0845
_______________________________________________________________________