Vulnerabilities have been discovered in Kerberos V5, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerabilities are caused due to boundary errors within the "krb5_aname_to_localname()" library function during conversion of Kerberos principal names into local account names. These can be exploited to cause heap-based buffer overflows by passing an overly long principal name when authenticating.

Exploitation may allow execution of arbitrary code on a vulnerable system with root privileges. However, this requires successful authentication to a vulnerable service, and the explicit mapping or rules-based mapping functionality has been enabled (not default configuration).

The vulnerabilities affect version 1.3.3 and prior.

Solution
Disable the affected functionality or apply patch:
Further details available in Customer Area

Provided and/or discovered by
Christopher Nebergall
Nico Williams

Changelog
Further details available in Customer Area

Original Advisory
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-001-an_to_ln.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area