Secunia

Michael Tautschnig has reported a vulnerability in Kerberos V5, which potentially can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to a boundary error in the libkadm5srv administration library within the "add_to_history()" function during the password history handling. This can be exploited to cause a heap-based buffer overflow when a principal changes the password and has a certain password history state.

Successful exploitation may allow execution of arbitrary code on a vulnerable Key Distribution Center (KDC) server. However, this requires that the administrator has performed a certain password policy change.

The vulnerability has been reported in version 1.3.5 and prior.

Solution
Apply patch for version 1.3.5:
Further details available in Customer Area

Provided and/or discovered by
Michael Tautschnig

Original Advisory
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2004-004-pwhist.txt

Deep Links
Links available in Customer Area