Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Mike Friedman
2004-002-patch_1.2.7.txt http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt The associated detached PGP signature is at: http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt.asc I find that the PGP signature doesn't verify. Is anyone

Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Andreas
On Wed, Sep 01, 2004 at 08:19:33AM -0700, Mike Friedman wrote: 2004-002-patch_1.2.7.txt http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt The associated detached PGP signature is at:

Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Jeffrey Hutzelman
*** WARNING *** I'm going to start an exchange to try to determine whether Mike has the correct bits and why he can't verify the signature. It should be noted that this entire exchange is occuring over unprotected email, and so it is a bad idea to rely on statements made by either of us like

Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Mike Friedman
On Wed, 1 Sep 2004 at 13:44 (-0300), Andreas wrote: On Wed, Sep 01, 2004 at 08:19:33AM -0700, Mike Friedman wrote: 2004-002-patch_1.2.7.txt http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt The associated detached PGP signature is at:

kpasswd failure due to time out

2004-09-01 Thread dkuhl
Hi, I have this problem with kpasswd. I can't seem to get it to function properly. I always get the following dialog: [EMAIL PROTECTED]:~$ kpasswd Password for [EMAIL PROTECTED]: Enter new password: : Enter it again: : kpasswd: Connection timed out changing password I've googled all over the

Re: Key derivation with non-ASCII characters

2004-09-01 Thread Frank Taylor
No, although an explanation of why the problem is hard and why in general you may not be able to solve it is in draft-ietf-krb-wg-kerberos-clarifications (successor to RFC 1510). Thanks for the pointer... I have now found: Encryption and Checksum Specifications for Kerberos 5

Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Andreas
On Wed, Sep 01, 2004 at 10:06:49AM -0700, Mike Friedman wrote: I have no trouble verifying the asn1 (MITKRB5-SA-2004-003) patch with PGP. Why can't I get -002 to verify? Any other ideas? I'm doing this on Solaris 8, using PGP 6.5.8. Well, I'm using gnupg. Perhaps there is some

Re: kpasswd failure due to time out

2004-09-01 Thread Ken Hornstein
That's all the ever appears in the log. I have the kadmin log segregated and nothing ever shows up in that log during this opperation. I thought the kadmind daemon was responsible for this but it never gets involved from what I can tell. Here's the problem: the admin server will _not_

Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Erik Arneson
On 01-Sep-2004, Mike Friedman [EMAIL PROTECTED] wrote: 2004-002-patch_1.2.7.txt http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt The associated detached PGP signature is at: http://web.mit.edu/kerberos/advisories/2004-002-patch_1.2.7.txt.asc

make check error

2004-09-01 Thread David . Estacio
I'm new to the list, I did download the archive and search it, but I didn't find anything that pointed me towards this. I'm hoping someone can help, or maybe give me some feedback on more troubleshooting steps. I'm running Aurora 1.0 (Redhat 7.x for SPARC platforms) and I have attempted to

Re: Key derivation with non-ASCII characters

2004-09-01 Thread Jeffrey Hutzelman
On Wednesday, September 01, 2004 07:20:00 -0700 Frank Taylor [EMAIL PROTECTED] wrote: No, although an explanation of why the problem is hard and why in general you may not be able to solve it is in draft-ietf-krb-wg-kerberos-clarifications (successor to RFC 1510). Thanks for the pointer... I

Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Chaskiel M Grundman
--On Wednesday, September 01, 2004 17:25:59 + Mike Friedman [EMAIL PROTECTED] wrote: I have no trouble verifying the asn1 (MITKRB5-SA-2004-003) patch with PGP. Why can't I get -002 to verify? Any other ideas? I'm doing this on Solaris 8, using PGP 6.5.8. It appears as though pgp 6 does

Re: MITKRB5-SA-2004-002: double-free vulnerabilities

2004-09-01 Thread Mike Friedman
On Wed, 1 Sep 2004 at 15:00 (-0400), Chaskiel M Grundman wrote: It appears that gnupg removes trailing blanks from every line, and pgp6 does not. The following scriptlet will convert one of these patch files into a form that pgp 6.5.8/linux is able to verify for me: perl -ne