Kerberos 5 Release 1.1.1

• Announcement
• Known Bugs
• Retrieving

Kerberos 5 Release 1.1.1 is Now Available

• Lots of Makefile rearranged to allow CFLAGS to be used by the builder.

• A possible ksu security bug was fixed.

• String parsing library security bugs related to the ksu security were fixed.

• Syslog-based logging denial-of-service vulnerability fixed.

• ASN.1 parser null sequence bug fixed; this resulted in KDC non-response in some cases of client misconfiguration.

• Workaround installed for 1.0.x KDC encrypted timestamp preauth bug; this caused a krb5-1.1 kinit to fail against a 1.0.x KDC under certain conditions.

• Config files that would result in an empty client enctype list now result in an error message.

• Entries in the krb4 to krb5 principal name conversion table have been fixed somewhat.

• kpasswd will no longer wait indefinitely for a response from a changepw server.

Kerberos 5 Release 1.1 is Now Available

• Triple DES support is included; however, it is only usable for service keys at the moment, due to a large number of compatibility issues. For example, the GSSAPI library has some (buggy) support for a triple DES session key, but it is intentionally disabled.

• The principal database now uses the btree backend of Berkeley DB. This should result in improved KDC performance.

• The build system has been redesigned somewhat; there are now no longer configure scripts for each individual directory.

• As part of the build system redesign, shared library builds are under a new framework; at this point only Solaris (2.x), Irix (6.5), NetBSD (1.4 i386), and possibly Linux are known to work. All other working shared library builds may be figments of your imagination.

• Mac and Windows builds should work better than they did in the 1.0 releases.

Known bugs

The list of known bugs may be found here.

Retrieving Kerberos 5 Release 1.1.1

You may retrieve the Kerberos 5 Release 1.1.1 source from here.