Secunia

Gaël Delalleau has reported two vulnerabilities in Kerberos V5, which can be exploited by malicious people to compromise a vulnerable system.

1) A boundary error in the "slc_add_reply()" function in the included telnet client when handling LINEMODE suboptions can be exploited to cause buffer overflow via a specially crafted reply containing a large number of SLC (Set Local Character) commands.

2) A boundary error in the "env_opt_add()" function in the included telnet client when handling NEW-ENVIRON suboptions can be exploited to cause a heap-based buffer overflow via a specially crafted reply containing a large number of characters that need escaping.

Successful exploitation allows execution of arbitrary code, but requires that a user connects to a malicious server with the vulnerable telnet client.

The vulnerabilities affect versions up to and including release krb5-1.4.

Solution
Apply patch:
Further details available in Customer Area

Provided and/or discovered by
Gaël Delalleau

Changelog
Further details available in Customer Area

Original Advisory
MIT:
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2005-001-telnet.txt

iDEFENSE:
http://www.idefense.com/application/poi/display?id=220&type=vulnerabilities
http://www.idefense.com/application/poi/display?id=221&type=vulnerabilities

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area