REDHAT-BUG-711419: High severity kerberos vulnerability
It was found that the kerberized FTP server did not properly check for the failure to set its effective group identifier (GID). A remote, authenticated FTP user could use this flaw to gain unauthorized read or write access to files whose group owner was the initial effective GID of the FTP daemon process.
References: [1] http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-005.txt (not public yet) [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1526
Upstream patch: [3] http://web.mit.edu/kerberos/advisories/2011-005-patch.txt
Acknowledgements:
Red Hat would like to thank the MIT Kerberos project for reporting this issue. Upstream acknowledges Tim Zingelman as the original reporter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-711419?
The severity of REDHAT-BUG-711419 is considered high due to the potential for unauthorized access to files.
How do I fix REDHAT-BUG-711419?
To fix REDHAT-BUG-711419, apply the patches provided in the relevant advisories for MIT Kerberos.
Who is affected by REDHAT-BUG-711419?
Users of the kerberized FTP server in MIT Kerberos are affected by REDHAT-BUG-711419.
What can an attacker do with REDHAT-BUG-711419?
An attacker could exploit REDHAT-BUG-711419 to gain unauthorized read or write access to files owned by the initial effective GID of the FTP daemon.
When was REDHAT-BUG-711419 identified?
REDHAT-BUG-711419 was identified in 2011.