Debian セキュリティ勧告

DSA-273-1 krb4 -- 暗号処理の脆弱性

報告日時:
2003-03-28
影響を受けるパッケージ:
krb4
危険性:
あり
参考セキュリティデータベース:
Mitre の CVE 辞書: CVE-2003-0138, CVE-2003-0139.
CERT の脆弱性リスト、勧告および付加情報: VU#623217, VU#442569.
詳細:

Kerberos プロトコルのバージョン 4 には暗号処理の部分に弱点があり、 攻撃者は、選択平文攻撃によってレルム内のどのプリンシパルにでも なりすますことができます。 krb4 の実装にはさらなる暗号処理の弱点があり、krb4 サービスで triple-DES が使用されている場合に、認証されていない クライアントプリンシパルのチケットをカットアンドペースト攻撃によって 偽造することができます。 これらの攻撃により、サイト全体の Kerberos 認証基盤を 破壊することができます。

現安定版 (stable)(woody) では、この問題はバージョン 1.1-8-2.3 で 修正されています。

旧安定版 (potato) では、この問題はバージョン 1.0-2.3 で 修正されています。

不安定版 (unstable)(sid) では、この問題はバージョン 1.2.2-1 で 修正されています。

krb4 パッケージを早急にアップグレードすることをお勧めします。

修正:

Debian GNU/Linux 2.2 (potato)

ソース:
http://security.debian.org/pool/updates/main/k/krb4/krb4_1.0-2.3.dsc
http://security.debian.org/pool/updates/main/k/krb4/krb4_1.0-2.3.diff.gz
http://security.debian.org/pool/updates/main/k/krb4/krb4_1.0.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.0-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.0-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.0-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-services_1.0-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-user_1.0-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-x11_1.0-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth1_1.0-2.3_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.0-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.0-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.0-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-services_1.0-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-user_1.0-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-x11_1.0-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth1_1.0-2.3_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.0-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.0-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.0-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-services_1.0-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-user_1.0-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-x11_1.0-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth1_1.0-2.3_i386.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.0-2.2_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.0-2.2_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.0-2.2_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-services_1.0-2.2_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-user_1.0-2.2_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-x11_1.0-2.2_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth1_1.0-2.2_m68k.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.0-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.0-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.0-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-services_1.0-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-user_1.0-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-x11_1.0-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth1_1.0-2.3_sparc.deb

Debian GNU/Linux 3.0 (woody)

ソース:
http://security.debian.org/pool/updates/main/k/krb4/krb4_1.1-8-2.3.dsc
http://security.debian.org/pool/updates/main/k/krb4/krb4_1.1-8-2.3.tar.gz
アーキテクチャ非依存コンポーネント:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-docs_1.1-8-2.3_all.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-services_1.1-8-2.3_all.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-user_1.1-8-2.3_all.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-x11_1.1-8-2.3_all.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth1_1.1-8-2.3_all.deb
Alpha:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_alpha.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_arm.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_i386.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_ia64.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_hppa.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_m68k.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_mips.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_s390.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-clients-x_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-dev-common_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kdc_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-kip_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/kerberos4kth-servers-x_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/libacl1-kerberos4kth_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/libkadm1-kerberos4kth_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/libkdb-1-kerberos4kth_1.1-8-2.3_sparc.deb
http://security.debian.org/pool/updates/main/k/krb4/libkrb-1-kerberos4kth_1.1-8-2.3_sparc.deb

一覧にあるファイルの MD5 チェックサムは勧告の原文にあります。