Knowledge Base

This patch updates the service console package for krb5 to krb5-libs-1.2.7-71 for addressing heap-based corruptions. The update addresses multiple integer underflow flaws that were found in the way the MIT Kerberos Key Distribution Center (KDC) decrypted ciphertexts. These ciphertexts are encrypted using the Advanced Encryption Standard (AES) and ARCFOUR (RC4) encryption algorithms. A specially-crafted AES- or RC4-encrypted ciphertext from a remote KDC client might potentially lead to either a denial-of-service of the central KDC or arbitrary code execution with the privileges of the KDC (root privileges).

The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2009-4212 to this issue.

Note: All virtual machines on the ESX host must be either shut down or migrated using vMotion before applying the patch. A reboot of the ESX host is required after applying this patch.

 

See the vCenter Update Manager Administration Guide for instructions on using Update Manager to download and install patches to automatically update ESX 3.5 hosts.