Secunia

A security issue has been reported in Kerberos, which potentially can be exploited by malicious, local users to perform certain actions with escalated privileges.

The security issue is caused due to missing checks for whether the "setuid()" call has succeeded in the bundled krshd and v4rcp applications. This can be exploited to disclose or manipulate the contents of arbitrary files or execute arbitrary code with root privileges if the "setuid()" call fails due to e.g. resource limits.

NOTE: This is currently only known to affect the Linux and AIX operating systems.

It has also been reported that similar missing checks exists for the "seteuid()" call in some bundled applications. However, this is currently not known to affect any operating systems.

The security issue has been reported in versions 1.5 and prior.

Solution
Apply patches. Note that the previous patches (revision 18419 in the diff header) introduced a new bug. Updated patches have been released to correct this problem.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Michael Calmer and Marcus Meissner, SUSE.

Changelog
Further details available in Customer Area

Original Advisory
http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2006-001-setuid.txt

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area