,欢迎您!
登录您的红帽帐户
尚未注册?下面是您应该进行注册的一些理由:
- 从一个位置浏览知识库文章、管理支持案例和订阅、下载更新以及执行其他操作。
- 查看组织内的用户,以及编辑他们的帐户信息、偏好设置和权限。
- 管理您的红帽认证,查看考试历史记录,以及下载认证相关徽标和文档。
您可以使用红帽帐户访问您的会员个人资料、偏好设置以及其他服务,具体决取决于您的客户状态。
出于安全考虑,如果您在公共计算机上通过红帽服务进行培训或测试,完成后务必退出登录。
退出红帽博客
Blog menu
A critical flaw was announced today that affects the MIT Kerberos telnet daemon, distributed with all versions of Red Hat Enterprise Linux. With this flaw, an attacker who can access the telnet port of a target machine could log in remotely as root without requiring a password.
The Kerberos telnet daemon is not enabled by default in any version of Red Hat Enterprise Linux. In addition, the default firewall rules block remote access to the telnet port.
This flaw is similar to the Solaris telnet daemon flaw reported earlier in the year, but the exact flaw and exploit mechanism are technically slightly different.
While we are not aware of this flaw being actively exploited at this time, we have confirmed that this would not be difficult. We therefore urge all users who have enabled the Kerberos telnet daemon to apply the update as soon as possible, and to disable the daemon in the meantime.
Updated packages to correct this issue, along with more details and advice, are available here, as well as via the Red Hat Network.
Red Hat would like to thank MIT for reporting this flaw. This issue was assigned CVE itentifier CVE-2007-0956 and was reported to the Red Hat security response team on February 21, 2007 with an embargo date of April 3, 2007.