blob: b16067e17f8b7f2f9fbcea40730c24c55b290801 [file] [log] [blame]
<?xml version="1.0" encoding="utf-8"?>
<glsa id="200701-14">
<title>Mod_auth_kerb: Denial of Service</title>
Mod_auth_kerb is vulnerable to a buffer overflow possibly allowing a Denial
of Service.
<product type="ebuild">mod_auth_kerb</product>
<announced>January 22, 2007</announced>
<revised>December 30, 2007: 02</revised>
<package name="www-apache/mod_auth_kerb" auto="yes" arch="*">
<unaffected range="ge">5.0_rc7-r1</unaffected>
<vulnerable range="lt">5.0_rc7-r1</vulnerable>
Mod_auth_kerb is an Apache authentication module using Kerberos.
Mod_auth_kerb improperly handles component byte encoding in the
der_get_oid() function, allowing for a buffer overflow to occur if
there are no components which require more than one byte for encoding.
<impact type="normal">
An attacker could try to access a Kerberos protected resource on an
Apache server with an incorrectly configured service principal and
crash the server process. It is important to note that this buffer
overflow is not known to allow for the execution of code.
There is no known workaround at this time.
All mod_auth_kerb users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=www-apache/mod_auth_kerb-5.0_rc7-r1&quot;</code>
<uri link="">CVE-2006-5989</uri>
<metadata tag="requester" timestamp="Wed, 17 Jan 2007 22:33:24 +0000">
<metadata tag="bugReady" timestamp="Wed, 17 Jan 2007 22:40:53 +0000">
<metadata tag="submitter" timestamp="Thu, 18 Jan 2007 01:47:32 +0000">