[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Remote vulnerability in kadmind
-----BEGIN PGP SIGNED MESSAGE-----
- --On Friday, October 25, 2002 12:07:38 +0100 Dave Love <email@example.com>
> Måns Nilsson <firstname.lastname@example.org> writes:
>> From the advisory:
> Where should I have seen that? I've seen a recent MIT advisory on
> bugtraq, which may or may not be about the same thing, but not one for
> Heimdal. I now realize it's on the web site, but that's not explicit
> about how `you should disable [Kerberos 4 support]'.
> I think it would be useful if announcements were copied to
> heimdal-discuss, which is what I'd expect.
I agree. That is a listmaster question, though. OTOH, apparently Johan felt
this issue was so important that the discuss list *was* adressed, in this
very thread, actually. I fail to see why it could not be the norm, though.
>> So, if your 0.4 installs are built in v4 compatibility mode, yes, then
>> they are vulnerable.
> The web site implies I can fix the configuration without rebuilding --
> is that false?
Take kadmind out of inetd.conf. That's what I did the night between monday
and tuesday CET as I was recompiling to 0.5.1 on our KDC. Don't forget the
SIGHUP to inetd, and don't forget to reenable the services afterwards.
>> I'd upgrade anyway. Sensitive box, that KDC..
> That's why I'm asking, but it's not that easy to upgrade.
I just (to be safe) made a tar ball of /usr/athena and /usr/heimdal, and a
separate backup of the database, and built things the normal way, with
Kerberos4 first (both build and install) and Heimdal afterwards, pointing
heimdal to /usr/athena in the configure process. I installed, stopped the
services, and started them again. Worked flawlessly.
Other organisations might have more extensive Q&A or software management
procedures on top of that, though. YMMV.
Måns Nilsson Systems Specialist
+46 70 681 7204 KTHNOC MN1334-RIPE
We're sysadmins. To us, data is a protocol-overhead.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (OpenBSD)
-----END PGP SIGNATURE-----